What is the CVSS score of CVE-2026-14031?

CVE-2026-14031 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14031?

Yes, a patch is available for CVE-2026-14031. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14031

EUVD-2026-40718 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-5vw5-85qv-5fvj

Information Disclosure Google Red Hat

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted HTML (AV:N), active user interaction with file input required (UI:R), impact limited to UI integrity misrepresentation with no confidentiality or availability loss.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

0.0 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:22 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in File Input in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome's File Input component (versions prior to 150.0.7871.47) enables remote unauthenticated attackers to misrepresent the file selection interface through a crafted HTML page, potentially deceiving users into interacting with fraudulent UI elements. The flaw is classified as CWE-451 (UI Misrepresentation of Critical Information) and requires active user interaction with the malicious page, consistent with the CVSS UI:R metric. No public exploit code exists, CISA SSVC confirms exploitation status as none, and EPSS sits at a low 0.17% (7th percentile), collectively indicating negligible real-world exploitation pressure.

Technical ContextAI

The vulnerability resides in Chrome's File Input implementation, the browser subsystem responsible for rendering and handling HTML <input type="file"> elements. CWE-451 (UI Misrepresentation of Critical Information) indicates that Chrome fails to adequately guard the visual representation of the file picker widget, allowing attacker-controlled HTML to manipulate how this UI element is presented to the user. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome versions prior to 150.0.7871.47 across platforms. The Chromium team internally rated this Low severity, reflecting that impact is bounded to UI integrity with no confidentiality or availability component, and that meaningful exploitation requires deliberate user interaction rather than passive page load.

RemediationAI

Vendor-released patch: Chrome 150.0.7871.47. Upgrade to Chrome 150.0.7871.47 or later, as documented in the Google Chrome stable channel release advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's built-in auto-update mechanism will apply this automatically in most consumer deployments; enterprise administrators should verify rollout via Chrome Browser Cloud Management or applicable group policy. SUSE users should apply available Chromium package updates through standard distribution channels. No documented workaround exists; given the UI:R requirement, content filtering policies that restrict navigation to untrusted or unknown origins (e.g., via enterprise proxy or URL allowlists) would reduce exposure but carry significant usability trade-offs and are not a substitute for patching.