This vulnerability (CVE-2026-14045) in Google Chrome involves insufficient validation of untrusted input within the network component, which can be exploited by a remote attacker who has already compromised the renderer process. By leveraging a crafted HTML page, the attacker can cause leakage of cross-origin data. The issue affects Chrome versions prior to 150.0.7871.47. The CVSS 3.1 base score is 4.3, indicating medium severity, with attack vector network, low attack complexity, no privileges required, user interaction required, and impact limited to confidentiality. There is no explicit vendor advisory statement confirming a fix, but the affected version suggests that 150.0.7871.47 is the fixed version.

An attacker who has compromised the renderer process can exploit this vulnerability to leak cross-origin data, potentially exposing sensitive information from other origins. The impact is limited to confidentiality loss; integrity and availability are not affected. The vulnerability requires user interaction and no privileges, making exploitation less straightforward but still possible under certain conditions.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. The affected version is prior to 150.0.7871.47, which suggests that updating to version 150.0.7871.47 or later may address the issue. Until confirmation, users should apply the latest Chrome updates as they become available.