CVE-2026-14019 describes a medium severity vulnerability in Google Chrome's password management prior to version 150.0.7871.47. The flaw allows a remote attacker to leak cross-origin data by leveraging a crafted HTML page, resulting from inappropriate implementation in the password handling mechanism. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts confidentiality with high impact but no integrity or availability impact. Although a vendor advisory link is provided, it does not explicitly state whether a fix has been released or if mitigation is available.

The vulnerability enables remote attackers to leak sensitive cross-origin data, compromising confidentiality. There is no impact on integrity or availability. No known exploits have been reported in the wild, reducing immediate risk, but the medium severity and CVSS score of 6.5 indicate a significant confidentiality concern if exploited.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Until official fixes are confirmed, users should exercise caution with untrusted web content and avoid interacting with suspicious pages that could exploit this vulnerability.