What is the CVSS score of CVE-2026-14080?

CVE-2026-14080 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14080?

Yes, a patch is available for CVE-2026-14080. Update the affected software to the latest version immediately.

Chrome Android CVE-2026-14080

EUVD-2026-40767 MEDIUM

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-hvw7-vx9g-h75q

Authentication Bypass Google Red Hat Suse

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via malicious traffic with no auth needed, but user tab interaction required; impact is integrity-only navigation bypass with no data exposure or availability loss.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 18:36 vuln.today

CVSS changed

Jul 01, 2026 - 18:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in TabSwitcher in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via malicious network traffic. (Chromium security severity: Low)

AnalysisAI

Navigation restriction bypass in Google Chrome for Android (prior to 150.0.7871.47) allows a remote attacker to circumvent browser navigation controls through crafted malicious network traffic targeting the TabSwitcher component. The flaw stems from insufficient input validation (CWE-20) in the tab management UI and requires user interaction to trigger, limiting its practical reach. With an EPSS score of 0.17% (7th percentile), no public exploit code, no CISA KEV listing, and Chromium's own internal severity rating of Low, real-world exploitation risk is minimal despite network reachability.

Technical ContextAI

The vulnerable component is TabSwitcher, the Android-specific tab management UI layer in Google Chrome, which handles switching between open browser tabs. CWE-20 (Improper Input Validation) indicates that the component fails to adequately sanitize or validate externally controlled input - in this case, data arriving over the network - before using it in navigation logic. This allows attacker-controlled network traffic to influence tab navigation behavior in ways that circumvent intended restrictions, such as same-origin or navigation guard policies. The flaw is specific to Chrome on Android (not desktop Chrome) as reflected by the platform-scoped description. Affected versions are all Chrome for Android releases prior to 150.0.7871.47, per the EUVD entry ('Chrome 150.0.7871.47 <150.0.7871.47').

RemediationAI

Upgrade Google Chrome on Android to version 150.0.7871.47 or later, which contains the vendor-released patch. Chrome for Android typically updates automatically through the Google Play Store; users and administrators should verify that automatic updates are enabled and confirm the installed version is at or above 150.0.7871.47. The release advisory is available at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. If immediate upgrade is not possible, reducing exposure by avoiding untrusted or attacker-controlled networks (e.g., public Wi-Fi) limits the delivery vector for malicious network traffic, though this is not a substitute for patching. No additional workarounds were identified in the available data.