CVE-2026-14090 is an out of bounds memory read vulnerability in the CameraCapture feature of Google Chrome on ChromeOS. The root cause is insufficient validation of untrusted input, allowing a remote attacker to trigger an out of bounds read via a crafted HTML page. This can lead to high impact on confidentiality, integrity, and availability as indicated by the CVSS vector. The vulnerability affects Chrome versions prior to 150.0.7871.47. Although a vendor advisory link is provided, it does not explicitly state the remediation level or patch availability.

Successful exploitation of this vulnerability could allow a remote attacker to read memory out of bounds, potentially leading to disclosure of sensitive information, corruption of data, or application crashes. The CVSS score of 9.8 reflects a critical impact on confidentiality, integrity, and availability without requiring user interaction or privileges.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Until official confirmation, users should update to version 150.0.7871.47 or later once available. No additional mitigation recommendations are provided by the vendor advisory.