What is the CVSS score of CVE-2026-14123?

CVE-2026-14123 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14123?

Yes, a patch is available for CVE-2026-14123. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-14123

EUVD-2026-40810 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-vqw9-r72x-73gr

Information Disclosure Apple Google Suse

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted HTML with no privileges needed; user must navigate to the page (UI:R); impact is integrity-only (URL bar spoofing), no data exfiltrated or service disrupted.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:36 vuln.today

CVSS changed

Jul 01, 2026 - 16:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

DescriptionCVE.org

Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 150.0.7871.47 allows a remote attacker to display a fraudulent URL in the browser's address bar by delivering a crafted HTML page. The root cause is classified as CWE-451 (UI Misrepresentation of Critical Information), meaning the security UI fails to accurately reflect the true origin of displayed content - a condition that directly undermines phishing defenses. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Deliver crafted HTML link to iOS Chrome user

Delivery

User clicks link, opens page in Chrome for iOS

Exploit

Malicious page triggers navigation/redirect sequence

Execution

Omnibox displays spoofed trusted domain

Impact

User submits credentials to attacker-controlled page

Access

Deliver crafted HTML link to iOS Chrome user

Delivery

User clicks link, opens page in Chrome for iOS

Exploit

Malicious page triggers navigation/redirect sequence

Execution

Omnibox displays spoofed trusted domain

Impact

User submits credentials to attacker-controlled page

Vulnerability AssessmentAI

Exploitation	The attacker must convince a user to visit a crafted HTML page in Chrome for iOS - requiring at minimum one act of user interaction (UI:R per CVSS). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Multiple signals converge on a low-to-moderate real-world risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker sends a phishing link to a target iOS Chrome user directing them to a controlled page. The crafted HTML page triggers a navigation sequence - potentially using history manipulation, redirect chains, or iframe state confusion - that causes Chrome's Omnibox to display a trusted domain (e.g., 'bank.example.com') while the actual loaded content originates from the attacker's server. …
Remediation	Update Google Chrome on iOS to version 150.0.7871.47 or later, which resolves this issue per the vendor advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. … Detailed patch versions, workarounds, and compensating controls in full report.