What is the CVSS score of CVE-2026-14030?

CVE-2026-14030 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14030?

Yes, a patch is available for CVE-2026-14030. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14030

EUVD-2026-40717 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-xjcw-cwpv-wfvx

Information Disclosure Google Red Hat Suse

4.2

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

vuln.today AI

3.1 LOW

URL bar spoofing yields only integrity impact; A:N replaces vendor's A:L as no availability mechanism is described; remaining metrics match description and confirmed CVSS vector.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 02:38 vuln.today

CVSS changed

Jul 01, 2026 - 02:22 NVD

4.2 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.2

DescriptionCVE.org

Inappropriate implementation in SplitView in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Omnibox (URL bar) spoofing in Google Chrome on Linux prior to 150.0.7871.47 is possible through an inappropriate SplitView implementation, allowing remote attackers to display false URLs to victims who are tricked into performing specific UI gestures on a crafted HTML page. This CWE-451 class flaw undermines browser trust indicators and enables phishing scenarios, though exploitation is constrained by high attack complexity and mandatory user interaction. No public exploit code or active exploitation has been identified; a vendor patch is available in the stable channel release.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) identifies the root cause: a failure to correctly render security-critical UI state - the Omnibox address bar - under specific SplitView interaction conditions. SplitView is a Chrome Linux feature enabling split-window or side-by-side browsing modes; the inappropriate implementation allows the displayed URL to diverge from the actual origin when specific gesture sequences are triggered. The Omnibox is a primary browser trust signal; its corruption enables convincing phishing attacks without any need for network-layer interception. The vulnerability is platform-scoped to Linux builds of Chrome prior to 150.0.7871.47, as confirmed by the EUVD affected-version range and the Chromium issue tracker at issues.chromium.org/issues/488762971.

RemediationAI

Vendor-released patch: Chrome 150.0.7871.47 for Linux. Upgrade to this version or later via the stable channel update documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome auto-update typically handles this for consumer endpoints; enterprise administrators using managed Chrome deployments (via Google Admin Console or policy-managed ChromeOS) should confirm update propagation to Linux endpoints and verify the installed version reaches 150.0.7871.47. As a temporary compensating control before patching, users can be instructed to avoid interacting with unfamiliar or untrusted pages using SplitView gestures, though this is operationally difficult to enforce at scale and should not substitute for patching. Disabling SplitView functionality via Chrome policy, if available, would eliminate the attack surface entirely but may impact user productivity in environments that rely on split-browsing workflows.