What is the CVSS score of CVE-2026-14046?

CVE-2026-14046 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14046?

Yes, a patch is available for CVE-2026-14046. Update the affected software to the latest version immediately.

Google Chrome Android CVE-2026-14046

EUVD-2026-40733 MEDIUM

Origin Validation Error (CWE-346)

2026-06-30 chrome-cve-admin@google.com

GHSA-9xcq-v4mx-9rf3

Authentication Bypass Google Suse

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered SOP bypass requires active victim interaction to load a crafted page; only limited cross-origin integrity impact, with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 14:33 vuln.today

CVSS changed

Jul 01, 2026 - 14:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in CustomTabs in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Same-origin policy bypass in Google Chrome's CustomTabs component on Android (versions prior to 150.0.7871.47) permits remote attackers to perform limited cross-origin integrity violations by directing a victim to a crafted HTML page. The flaw is classified as CWE-346 (Origin Validation Error), meaning Chrome's CustomTabs implementation incorrectly validates or enforces origin boundaries when rendering attacker-controlled content. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Host crafted HTML page on attacker-controlled domain

Delivery

Distribute link via phishing or malicious ad

Exploit

Victim opens link in Android app using CustomTabs

Execution

Exploit origin validation error in CustomTabs implementation

Impact

Perform limited cross-origin write/integrity violation

Access

Host crafted HTML page on attacker-controlled domain

Delivery

Distribute link via phishing or malicious ad

Exploit

Victim opens link in Android app using CustomTabs

Execution

Exploit origin validation error in CustomTabs implementation

Impact

Perform limited cross-origin write/integrity violation

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to be using Google Chrome for Android (not desktop Chrome) on a version prior to 150.0.7871.47. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) accurately reflects a moderate, limited-impact flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker crafts a malicious HTML page hosted on an attacker-controlled domain and distributes a link through phishing, social media, or a compromised advertisement. When a victim on an Android device opens the link inside an app that uses CustomTabs to render web content, the crafted page exploits the origin validation error to perform limited cross-origin write operations - for example, injecting content into or modifying the apparent state of a page from a different origin loaded in the same session. …
Remediation	Update Chrome for Android to version 150.0.7871.47 or later via the Google Play Store. … Detailed patch versions, workarounds, and compensating controls in full report.