What is the CVSS score of CVE-2026-14028?

CVE-2026-14028 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14028?

Yes, a patch is available for CVE-2026-14028. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-14028

EUVD-2026-40716 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-mvjh-xxj9-wvhq

Information Disclosure Google Apple Red Hat Suse

4.2

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

vuln.today AI

3.1 LOW

UI spoofing is network-delivered (AV:N) with high complexity due to required gesture sequence (AC:H); no availability impact is substantiated by a UI-only misrepresentation flaw.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 02:37 vuln.today

CVSS changed

Jul 01, 2026 - 02:22 NVD

4.2 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.2

DescriptionCVE.org

Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome for iOS prior to 150.0.7871.47 allows a remote attacker to misrepresent security indicators to users who are socially engineered into performing specific UI gestures on a crafted HTML page. The root cause is incorrect rendering of security UI elements (CWE-451), classified by the Chromium team as Low severity. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog, aligning with the modest CVSS 4.2 score and the high-complexity attack requirements.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) describes flaws where security-relevant UI elements - such as address bar content, SSL/TLS lock icons, or origin indicators - can be manipulated or obscured, causing users to make trust decisions based on false information. Chrome for iOS runs as a distinct build atop the Chromium engine adapted for Apple's iOS platform, meaning certain UI chrome behaviors (navigation bar, security badges) may diverge from the desktop rendering path. The affected component is the iOS-specific security UI layer of Chrome versions prior to 150.0.7871.47. CPE data from EUVD confirms the affected version range as any Chrome for iOS release below 150.0.7871.47.

RemediationAI

Update Google Chrome on iOS to version 150.0.7871.47 or later via the Apple App Store. The vendor advisory is available at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html and the Chromium issue tracker entry is at issues.chromium.org/issues/401816601. Because the attack requires specific user-initiated UI gestures and a crafted HTML page, organizations that cannot immediately patch should advise users to be cautious of unfamiliar websites that prompt them to perform unusual interactions. Mobile device management (MDM) policies that enforce minimum Chrome version thresholds can help enforce compliance at scale. No effective compensating control short of upgrading the browser mitigates a browser-level UI rendering flaw.