This vulnerability (CVE-2026-14053) affects Google Chrome versions before 150.0.7871.47. It involves insufficient policy enforcement in the Extensions component, enabling a remote attacker with control over the renderer process to leak cross-origin data through a specially crafted HTML page. The issue is classified under CWE-346 (Insufficient Authorization). The CVSS 3.1 base score is 4.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impact limited to confidentiality. The vendor advisory linked does not explicitly state if a patch or fix is available, and no remediation level is provided.

An attacker who has already compromised the renderer process can exploit this vulnerability to leak cross-origin data, potentially exposing sensitive information from other origins. The impact is limited to confidentiality loss; integrity and availability are not affected. The vulnerability requires user interaction and no privileges, making exploitation possible but with some constraints. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The linked Google Chrome stable channel update announcement does not explicitly confirm a fix for this vulnerability. Users and administrators should monitor official Google Chrome release notes and apply updates promptly once a fix is confirmed.