CVE-2026-14087 describes a heap buffer overflow in the WebNN feature of Google Chrome on Windows platforms before version 150.0.7871.47. The vulnerability arises from insufficient validation of untrusted input, enabling an attacker with renderer process access to cause heap corruption through a specially crafted HTML page. This issue is acknowledged by Google and publicly documented, but no CVSS score or detailed exploitation information is provided. The vulnerability is rated as low severity by the Chromium security team.

The vulnerability could allow an attacker who has already compromised the renderer process to exploit heap corruption, potentially leading to further compromise or instability of the browser process. However, the impact is limited by the prerequisite that the attacker must have renderer process access, and the severity is assessed as low.

A fixed version, 150.0.7871.47, is available. Users should update Google Chrome on Windows to version 150.0.7871.47 or later to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.