CVE-2026-14015 is a race condition vulnerability in the WebRTC implementation of Google Chrome on Windows platforms before version 150.0.7871.47. This flaw enables a remote attacker to leak cross-origin data by exploiting a timing issue via a specially crafted HTML page. The vulnerability has been assigned a medium severity level by Chromium security and carries a CVSS 3.1 base score of 6.5, reflecting a network attack vector with low attack complexity, no privileges required, but requiring user interaction. The impact is limited to confidentiality loss without integrity or availability impact.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of cross-origin data, compromising user privacy by leaking sensitive information accessible through WebRTC. There is no impact on data integrity or system availability. No known exploits are reported in the wild at this time.

Google Chrome version 150.0.7871.47 addresses this vulnerability. Users should update to this version or later to mitigate the risk. No additional vendor advisories indicate alternative mitigations or that no action is required. Patch status is not explicitly confirmed in the advisory, but the presence of the fixed version implies an official fix is available.