## Summary
A use-after-free vulnerability in Google Chrome DevTools (Chromium) prior to 150.0.7871.47 could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. The issue is tracked as CVE-2026-14091 (CWE-416).
## Technical Details
- Vulnerability class: CWE-416 (Use After Free).
- Affected component: Chrome DevTools.
- Trigger: opening a crafted HTML page that exercises the DevTools code path leading to a use-after-free condition.
- Result: arbitrary code execution inside a sandbox.
- Scope: the NVD description indicates the attacker’s code runs within the browser sandbox (not full system compromise).
## Affected
- Google Chrome versions: prior to 150.0.7871.47 (also stated as < 150.0.7871.46 in the provided affected products).
## Impact
- Remote attacker can achieve code execution by delivering a crafted HTML page.
- Consequences indicated by the provided CVSS vector include high potential impact to confidentiality, integrity, and availability (C:H/I:H/A:H).
## Mitigation
1. Update Google Chrome to 150.0.7871.47 or later to remove the vulnerable code path.
2. If immediate updating is not possible, reduce exposure by avoiding opening untrusted HTML content in Chrome, since exploitation is described as requiring a crafted page (user interaction is indicated by UI:R).
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-416