CVE-2026-14027 is a use-after-free vulnerability (CWE-416) in the SignIn functionality of Google Chrome before version 150.0.7871.47. An attacker who persuades a user to engage in certain UI gestures on a maliciously crafted HTML page may trigger heap corruption, potentially leading to remote code execution or other impacts. The vulnerability is rated high severity with a CVSS 3.1 base score of 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. There is no explicit vendor remediation level stated, but the affected versions are prior to 150.0.7871.47, indicating that this version includes the fix. The vendor advisory link is provided for further details.

Successful exploitation can lead to heap corruption resulting in potential remote code execution or other severe impacts on confidentiality, integrity, and availability of the affected system. The vulnerability requires user interaction and specific UI gestures, limiting the attack vector to scenarios where a user is tricked into interacting with a crafted HTML page.

Users and administrators should update Google Chrome to version 150.0.7871.47 or later to remediate this vulnerability. The vendor advisory indicates that this version includes the fix. No additional mitigations are specified or required beyond applying the update.