This vulnerability (CVE-2026-14047) affects Google Chrome versions before 150.0.7871.47. It arises from insufficient enforcement of policies in Chrome extensions, specifically allowing a malicious extension to bypass content security policy restrictions. The issue requires user interaction, as the attacker must convince the user to install the malicious extension. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. The vendor advisory link is provided but does not explicitly confirm patch status or remediation level in the input data.

An attacker who successfully convinces a user to install a malicious Chrome extension can bypass content security policies, potentially leading to limited integrity impacts within the browser environment. There is no direct confidentiality or availability impact reported. The vulnerability requires user interaction and does not require privileges, making social engineering the primary exploitation vector. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Until an official fix is confirmed, users should avoid installing untrusted or suspicious Chrome extensions and follow best practices for extension management.