What is the CVSS score of CVE-2026-14042?

CVE-2026-14042 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14042?

Yes, a patch is available for CVE-2026-14042. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14042

EUVD-2026-40729 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-j4r2-33qc-jrrj

Information Disclosure Google Red Hat

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted HTML page requiring victim interaction; no attacker authentication; limited integrity impact only through UI misrepresentation, no C or A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:22 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Isolated Web Apps in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome's Isolated Web Apps (IWA) subsystem allows remote unauthenticated attackers to misrepresent security-relevant interface elements to victims via a specially crafted HTML page, affecting all Chrome versions prior to 150.0.7871.47. The vulnerability is rooted in CWE-451 (UI Misrepresentation of Critical Information) and is limited to low-integrity impact with no confidentiality or availability consequence. No public exploit identified at time of analysis; EPSS at 0.17% (7th percentile) and SSVC exploitation status of 'none' both indicate negligible real-world exploitation likelihood.

Technical ContextAI

Isolated Web Apps (IWA) is a Chrome security model designed to provide stronger isolation guarantees than standard web origins, enabling installable web applications with elevated trust signals surfaced through browser UI. CWE-451 describes failures where the user interface inaccurately conveys security-critical information - in this case, an inappropriate implementation within IWA's UI rendering logic allows a crafted HTML page to manipulate or spoof interface elements such as origin indicators, permission dialogs, or app-identity chrome. The affected product scope per CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all platform variants of Google Chrome below version 150.0.7871.47. SUSE is also tagged, suggesting downstream packaging in SUSE Linux distributions may carry the vulnerable Chrome build.

RemediationAI

Vendor-released patch: Google Chrome 150.0.7871.47. Update Chrome to version 150.0.7871.47 or later via the built-in updater (chrome://settings/help) or by deploying the stable channel release documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism should apply this fix automatically for most consumer and enterprise-managed deployments; administrators should verify fleet version compliance via Chrome Browser Cloud Management or equivalent MDM tooling. For SUSE Linux environments, apply the vendor-supplied Chrome package update through the standard SUSE security channel. No workaround short of disabling Isolated Web Apps usage is practical, and given the trivial patch path, no compensating control is necessary.