What is the CVSS score of CVE-2026-14068?

CVE-2026-14068 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14068?

Yes, a patch is available for CVE-2026-14068. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14068

EUVD-2026-40755 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-30 chrome-cve-admin@google.com

GHSA-9fhc-3m22-q4wr

XSS Google Apple Red Hat Suse

6.1

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Network-delivered, no auth needed, scope changed due to UXSS cross-origin impact; user must actively perform gestures (UI:R); no availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 14:37 vuln.today

CVSS changed

Jul 01, 2026 - 14:22 NVD

6.1 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.1

DescriptionCVE.org

Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Universal Cross-Site Scripting (UXSS) in Chrome's Omnibox on iOS enables remote attackers to inject arbitrary scripts or HTML across security origins by luring users into performing specific UI gestures on a crafted page. Affected versions are Chrome for iOS prior to 150.0.7871.47; the desktop channel is not affected. No public exploit code or active exploitation has been identified at time of analysis, and EPSS sits at 0.18% (8th percentile), consistent with Chromium's own 'Low' severity rating despite the scope-changed CVSS vector.

Technical ContextAI

The Omnibox is Chrome's unified address-bar and search-input component. On iOS, an inappropriate implementation (CWE-79: Improper Neutralization of Input During Web Page Generation) in Omnibox processing allows user-triggered UI gestures to be exploited for UXSS - a class of XSS that bypasses the Same-Origin Policy and can read or write data across all open origins, not just the attacker's own origin. The CVSS scope metric S:C reflects this cross-origin reach. The flaw is iOS-specific, suggesting it relates to platform-level UIKit gesture handling or iOS WKWebView integration in the Omnibox, rather than Chromium's cross-platform rendering engine. The EUVD-2026-40755 record and Chromium issue tracker entry 504210171 corroborate the advisory.

RemediationAI

Update Google Chrome on iOS to version 150.0.7871.47 or later, available through the Apple App Store. This is the vendor-released patch and is the primary and recommended fix. Organizations managing iOS device fleets via MDM should deploy the update through their mobile management solution and confirm version compliance via device inventory. No official workaround is documented; if patching is delayed, restricting access to untrusted or external web content via enterprise content filtering reduces exposure, though this has operational trade-offs for general browsing use. The vendor advisory is at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html.