CVE-2026-14049 is an information disclosure vulnerability in the GPU component of Google Chrome versions before 150.0.7871.47. It enables a remote attacker, with control over the renderer process, to extract potentially sensitive data from process memory by leveraging a specially crafted HTML page. The vulnerability is related to an inappropriate implementation that leads to unintended data exposure. The CVSS v3.1 base score is 5.3, reflecting a medium severity with network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact but no integrity or availability impact. There are no known exploits in the wild at this time. The vendor has published an advisory linked to a stable channel update addressing this issue.

An attacker who has already compromised the renderer process in Chrome can exploit this vulnerability to obtain sensitive information from process memory. This could lead to leakage of confidential data. However, exploitation requires prior compromise of the renderer process and user interaction, limiting the ease of exploitation. There is no impact on integrity or availability.

A fix is available in Google Chrome version 150.0.7871.47. Users and administrators should update to this version or later to remediate the vulnerability. The vendor advisory linked confirms the availability of this update. No additional mitigations are specified.