What is the CVSS score of CVE-2026-14072?

CVE-2026-14072 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14072?

Yes, a patch is available for CVE-2026-14072. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14072

EUVD-2026-40759 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-g2ff-x9mq-9xh3

Information Disclosure Google Red Hat

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network delivery via crafted HTML with mandatory user navigation (UI:R); spoofing yields low integrity impact only, no auth required, no scope change or confidentiality/availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:21 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in SplitView in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome's SplitView feature prior to version 150.0.7871.47 enables remote attackers to misrepresent the origin or content of browser UI elements by delivering a crafted HTML page to a victim. Exploitation is limited to integrity impact only - no data exfiltration or availability disruption is possible directly - though the spoofing could facilitate social engineering leading to credential theft. No public exploit code exists and EPSS is negligible at 0.17% (7th percentile), classifying this as a routine-patch-cycle item despite Chrome's ubiquitous deployment.

Technical ContextAI

The flaw is rooted in CWE-451 (User Interface Misrepresentation of Critical Information), a class of vulnerabilities where UI components fail to accurately convey security-relevant context - such as origin indicators, security dialogs, or address bar content - allowing attackers to mislead users about what they are interacting with. SplitView is a Chromium browser-level feature enabling side-by-side or split-screen content display, and the 'inappropriate implementation' suggests it fails to enforce proper visual or contextual separation between origins or trust boundaries when rendering attacker-controlled HTML. The affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* across all variants prior to 150.0.7871.47, spanning Windows, macOS, and Linux desktop platforms. The SUSE tag indicates downstream distribution packaging is also in scope.

RemediationAI

Update Google Chrome to version 150.0.7871.47 or later, the patched release confirmed by Google's stable channel update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Most desktop users with auto-update enabled will receive this fix automatically. Enterprise administrators should verify fleet rollout via Chrome Enterprise management consoles. SUSE Linux users and administrators should apply the corresponding distribution-packaged Chromium update when available through standard package management channels. No documented workarounds exist for the SplitView flaw specifically; in environments with delayed update pipelines, deploying web content filtering to block access to untrusted or unvetted HTML sources reduces the likelihood of a victim encountering a crafted page, though this is not a complete mitigation and introduces usability trade-offs.