What is the CVSS score of CVE-2026-14089?

CVE-2026-14089 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14089?

Yes, a patch is available for CVE-2026-14089. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14089

EUVD-2026-40776 MEDIUM

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-92hw-39hg-4r93

Information Disclosure Google Red Hat Suse

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

3.1 LOW

Renderer compromise is a non-trivial chained prerequisite raising AC to H; UI spoofing yields only low integrity impact with no C or A.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

3.5 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:35 vuln.today

CVSS changed

Jul 01, 2026 - 16:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

DescriptionNVD

Insufficient validation of untrusted input in PopupBlocker in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome's PopupBlocker component (all versions prior to 150.0.7871.47) enables a remote attacker who has already compromised the Chrome renderer process to manipulate browser UI elements through a crafted HTML page. The integrity impact is limited to UI deception - no code execution, credential theft, or availability impact is possible through this flaw alone. EPSS at 0.17% (7th percentile) and Chromium's own 'Low' severity rating align with the constrained exploit chain; no public exploit or CISA KEV listing exists at time of analysis.

Technical ContextAI

The vulnerability resides in Chrome's PopupBlocker, the browser-process component responsible for intercepting and filtering popup window requests originating from sandboxed renderer processes. Chrome's multi-process architecture enforces privilege separation via IPC between the renderer (low-privilege, sandboxed) and the browser process (higher-privilege). CWE-20 (Improper Input Validation) identifies the root cause: the PopupBlocker fails to adequately validate attacker-controlled data arriving over that IPC channel when the renderer has been compromised. Affected CPE covers desktop Chrome installations across Windows, macOS, and Linux prior to version 150.0.7871.47, as confirmed by the EUVD entry EUVD-2026-40776.

RemediationAI

Upgrade Google Chrome to version 150.0.7871.47 or later, which contains the vendor-released patch per Google's stable channel update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism handles this for most consumer deployments; enterprise administrators using managed Chrome deployments (Google Admin Console or third-party MDM) should verify the version floor is enforced via policy and confirm update delivery. No documented workaround for the PopupBlocker flaw itself exists; however, given that exploitation requires prior renderer compromise, organizations can reduce upstream risk by ensuring Chrome's sandbox is not disabled (e.g., avoid '--no-sandbox' launch flags in enterprise packaging) and by applying all prior Chrome security patches to eliminate potential renderer-compromise entry points.