CVE-2026-14106 is a flaw (CVSS 9.6 in the record) in Text in Google Chrome on Android before 150.0.7871.47. Insufficient validation of untrusted input could let an attacker who compromised the renderer escape the sandbox via a crafted page. Chromium rates it Low. Update Chrome.
What's affected
The record says Google Chrome prior to 150.0.7871.47 is affected, on Android for this issue. The fixed version is 150.0.7871.47 or later. The record points to the June 2026 Chrome stable channel update post for the desktop release notes. That page loads its content with scripts and did not render for our fetch, so open it in a browser to see the exact build numbers per platform.
Other Chromium based browsers take Chromium fixes on their own schedule, so check each vendor.
How to check if you're exposed
Open chrome://version in the address bar and read the version number. Anything below 150.0.7871.47 is in range. To trigger an update, open the three dot menu, choose Help, then About Google Chrome, and relaunch when asked.
For managed fleets, check the version through your device management console or with a script that reads the installed Chrome version on each platform.
On Android, open Chrome, then Settings, then About Chrome to read the version, or check the app page in the store for the installed build.
What to do now
- Open chrome://version and check the build is 150.0.7871.47 or later.
- Use About Google Chrome to update and relaunch the browser.
- Confirm your fleet policy lets Chrome update, and relaunch long running sessions.
- Check other Chromium based browsers and embedded runtimes such as Electron apps against their vendor advisories.
- Keep an eye on the Chrome releases blog for new stable updates.
Why it matters
The class is improper input validation, in the text handling code on Android. As with other bugs in this release, the record says the attacker needs a compromised renderer first, and Chromium rates the severity Low even though the vector gives 9.6.
Mobile browsers are easy to forget in patch tracking. Managed Android devices need the store update to land, and unmanaged ones depend on automatic updates. The record does not flag the CVE as known exploited.
The record lists this weakness class: CWE-20 (Improper Input Validation).
Quick check
How do I update Chrome on Android?
Update it through the app store, then reopen the app and check the version under Settings and About Chrome.
Sources
Last reviewed: 19 October 2026.
