CVE-2026-2314
Published: 11 February 2026
Summary
CVE-2026-2314 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked in the top 10.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-2314 is a heap buffer overflow vulnerability (CWE-122, CWE-787) in the Codecs component of Google Chrome prior to version 145.0.7632.45. The flaw enables a remote attacker to potentially exploit heap corruption by processing a crafted HTML page. Chromium rates this as High severity, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
A remote attacker without privileges can exploit this vulnerability over the network with low complexity by tricking a user into visiting a malicious site containing the crafted HTML page, which requires user interaction. Successful exploitation could lead to heap corruption, granting high impacts on confidentiality, integrity, and availability, such as potential arbitrary code execution.
Mitigation details are available in the Chrome stable channel update for desktop at https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_10.html and the Chromium issue tracker at https://issues.chromium.org/issues/478560268, which address the vulnerability in version 145.0.7632.45 and later.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-6214
Vulnerability details
Heap buffer overflow in Codecs in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow in Chrome enables drive-by compromise via crafted HTML and direct client-side code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the heap buffer overflow vulnerability by requiring timely installation of the Chrome security update to version 145.0.7632.45 or later.
Implements memory protection mechanisms such as ASLR and DEP that directly mitigate heap corruption exploits from crafted HTML pages in Chrome's Codecs.
Provides process isolation through browser sandboxing to limit the impact of heap overflow exploitation in the Codecs component.