CVE-2026-14040 is a use-after-free vulnerability in the BrowserTag feature of Google Chrome before version 150.0.7871.47. An attacker could exploit this by tricking a user into installing a crafted malicious Chrome extension, which may lead to heap corruption. The issue is recognized by the Chromium security team with a low severity rating. No CVSS score is provided. The vendor has published a stable channel update addressing this issue in Chrome 150.0.7871.47.

Successful exploitation could result in heap corruption, potentially leading to arbitrary code execution or browser instability. However, exploitation requires user interaction in the form of installing a malicious extension. The severity is considered low, indicating limited impact or difficulty in exploitation.

Users should update Google Chrome to version 150.0.7871.47 or later, where this vulnerability is fixed. The vendor advisory confirms the availability of this update. No additional mitigation steps are specified or required beyond applying the official update.