CVE-2026-14385 in Google Chrome ANGLE
Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 150.0.7871.46 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
Quick answer
Google Chrome should be reviewed and updated if it matches the affected versions. The recommended fix is to apply the vendor-supported patched version or the mitigation steps below, then retest the public website with Fixnx.
Who is affected
Affected versions
- Google Chrome before 150.0.7871.46
Fixed versions
- Google Chrome 150.0.7871.46 or later
- Google Chrome 150.0.7871.46/.47 or later on Windows and Mac
How to fix it
CVE-2026-14385 affects Google Chrome before 150.0.7871.46. The issue means a crafted HTML page may cause unsafe memory access. Treat it as urgent for browsers used by staff, admins, or customers. Update Chrome to Google Chrome 150.0.7871.46 or later, or use the managed browser update policy for your fleet.
- Inventory Chrome versions on all desktops, laptops, servers with browsers, and managed devices.
- Find any Chrome install older than 150.0.7871.46.
- Update Chrome to Google Chrome 150.0.7871.46 or later.
- Force a browser restart where updates are pending.
- Limit risky browsing and untrusted extensions until updates are complete.
- Review endpoint alerts for browser crashes, exploit warnings, or blocked downloads.
- Document the update status for managed devices.
Scan now. Google sign-in is only needed to unlock fix guidance.
Verify the fix
- Confirm Chrome reports version Google Chrome 150.0.7871.46 or later.
- Confirm managed devices show the updated browser version in your admin console.
- Confirm no older Chrome versions remain on exposed or shared systems.
- Review endpoint logs again after patching for browser exploit signals.
- Run a new Fixnx scan if the affected browser is part of a web testing or public workflow.
Related categories
Trusted references
FAQ
What is affected by CVE-2026-14385?
Google Chrome versions listed as affected should be reviewed: Google Chrome before 150.0.7871.46.
What should I fix first?
Start with internet-facing sites, admin panels, login flows, plugins, themes, modules, packages, and systems that process user-controlled input or sensitive data.
How do I confirm the fix worked?
Apply the patched version or mitigation, clear caches where relevant, retest the affected workflow, and run a new Fixnx scan to verify public website exposure signals.
How are Fixnx security risk categories chosen?
Fixnx keeps one canonical risk page and assigns only broad, relevant categories such as ecosystem, technology area, or vulnerability class.