What is the CVSS score of CVE-2026-14014?

CVE-2026-14014 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14014?

Yes, a patch is available for CVE-2026-14014. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14014

EUVD-2026-40702 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-pxf9-8xfq-9xvg

Information Disclosure Google Red Hat Suse

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Remotely triggered via crafted HTML (AV:N, AC:L, PR:N, UI:R); spoofing yields only integrity impact with no confidentiality or availability consequence (C:N, I:H, A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.4 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:34 vuln.today

CVSS changed

Jul 01, 2026 - 16:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome's Paint rendering component (versions prior to 150.0.7871.47) enables remote attackers to misrepresent browser interface elements through a specially crafted HTML page, with the victim's visit being the sole prerequisite. The CVSS vector confirms high integrity impact (I:H) with no confidentiality or availability exposure, consistent with CWE-451 misrepresentation of critical UI information rather than code execution. No public exploit has been identified and EPSS sits at the 7th percentile (0.17%), indicating very low near-term exploitation probability; a vendor patch is confirmed available in the Chrome stable channel.

Technical ContextAI

The vulnerability resides in Chrome's Paint subsystem - the rendering pipeline stage responsible for drawing composited UI frames to the display surface. CWE-451 (User Interface Misrepresentation of Critical Information) identifies the root cause class: the Paint implementation fails to correctly enforce boundaries or trusted rendering context, allowing attacker-controlled HTML content to influence the appearance of browser chrome elements such as the address bar, origin indicators, or security dialogs. This is a classic browser UI confusion bug where the renderer does not sufficiently isolate page-controlled pixels from browser-controlled UI pixels. Affected CPE corresponds to Google Chrome for desktop platforms (Windows, macOS, Linux) in the stable channel prior to build 150.0.7871.47.

RemediationAI

Update Google Chrome to version 150.0.7871.47 or later via the Chrome stable channel; this is the confirmed vendor-released patch per the advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism will apply this in most managed and consumer environments, but administrators should verify deployed versions via fleet management tooling. No vendor-documented workaround exists for this specific Paint rendering flaw. As a compensating control for high-risk environments where immediate patching is not possible, restricting browser access to untrusted or unknown web origins via a web proxy or DNS filtering layer can reduce exposure surface, though this does not eliminate the vulnerability and imposes usability trade-offs. Browser isolation technologies (e.g., remote browser isolation) can also contain the impact of UI spoofing by rendering external pages in an isolated context.