CVE-2026-2314 – Chromium Multiple Security Vulnerabilities

CVSS 8.8 IMPORTANT

“Several high-severity browser bugs that could crash Chromium or let attackers run malicious code or trick users into unsafe actions.”

Chromium addressed multiple vulnerabilities in its browser engine, fixed in updates such as Chrome/Chromium version 145.0.7632.45 and later. These include CVE-2026-2314, CVE-2026-2316, CVE-2026-2319, and CVE-2026-2322, each involving different components of the browser and various potential impacts.

  • CVE-2026-2314 – A heap buffer overflow in the Codecs component that could be triggered by a malicious HTML page, potentially leading to remote code execution or memory corruption. This issue is rated CVSS v3.1 8.8 (High).
  • CVE-2026-2316 – Insufficient policy enforcement in Frames could allow UI spoofing via crafted content. This flaw carries a CVSS v3.1 score of 6.5 (Medium).
  • CVE-2026-2319 – A race condition in the DevTools component that can enable object corruption if a user is tricked into specific interactions; it is rated CVSS v3.1 7.5 (High).
  • CVE-2026-2322 – An issue in File input UI handling that could let an attacker manipulate the user interface to spoof file dialogs; it is rated CVSS v3.1 4.3 (Medium).

These vulnerabilities generally require a remote attacker to convince a user to interact with crafted web content, and they can affect confidentiality, integrity, and in some cases execution flow of the browser. While there are no widely confirmed exploit reports in the wild yet, the presence of heap overflows and race conditions means prompt updating to the fixed Chromium/Chrome builds is important to mitigate risk. Upgrade to the latest browser releases to ensure these issues are resolved. 

Key Details

Affected Product
Google Chrome
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
CWE Classification
CWE-122
Patch this CVE on all your endpoints in under 5 minutes. First 200 endpoints are free forever, scale as needed.