What is the CVSS score of CVE-2026-14128?

CVE-2026-14128 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14128?

Yes, a patch is available for CVE-2026-14128. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-14128

EUVD-2026-40815 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-wx3w-r2pw-7wxr

Information Disclosure Google Apple Red Hat

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page, requires victim navigation (UI:R); impact is solely UI integrity misrepresentation with no data exposure or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:12 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Omnibox spoofing in Google Chrome for iOS prior to 150.0.7871.47 enables remote attackers to display false URL content in the browser's address bar by luring a user to a crafted HTML page, creating a credible phishing vector. The flaw stems from inappropriate implementation in the iOS-specific Omnibox rendering logic (CWE-451), distinct from Chrome's desktop codebase. No public exploit code has been identified and EPSS sits at 0.18% (8th percentile), indicating negligible opportunistic exploitation probability at this time.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) describes flaws where security-relevant UI elements - in this case the Omnibox address bar - can be manipulated to display content that misrepresents the true origin or state of a page. The Omnibox is Chrome's primary trust indicator on mobile; if its displayed URL can be overridden by attacker-controlled HTML, users lose the ability to verify site authenticity. The CPE string (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers Chrome broadly, but the description and EUVD affected-version entry explicitly scope this to the iOS platform build, implying the flaw is in iOS-specific Omnibox rendering code rather than the shared Blink/Chromium engine. The Chromium security severity is rated Low, consistent with the limited direct data exposure (C:N in the CVSS vector).

RemediationAI

Update Google Chrome for iOS to version 150.0.7871.47 or later via the Apple App Store; this is the vendor-released patch confirmed by the Google Chrome Releases advisory at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Enterprise MDM administrators managing iOS fleets should push this update through Apple Business Manager or equivalent tooling. As a compensating control prior to patching, users can manually verify destination URLs before submitting credentials by long-pressing links to inspect the actual destination, though this does not eliminate the spoofing surface and has significant usability trade-offs. There are no known server-side mitigations since the flaw resides entirely in the client application.