What is the CVSS score of CVE-2026-14129?

CVE-2026-14129 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14129?

Yes, a patch is available for CVE-2026-14129. Update the affected software to the latest version immediately.

Google Chrome Android CVE-2026-14129

EUVD-2026-40816 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-mc52-82m8-rrw6

Information Disclosure Google Red Hat Suse

4.2

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

vuln.today AI

4.2 MEDIUM

Network-delivered via crafted page, but AC:H due to mandatory specific gesture sequence; UI spoofing yields only limited integrity and availability impact with no direct confidentiality breach.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 02:43 vuln.today

CVSS changed

Jul 01, 2026 - 02:22 NVD

4.2 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.2

DescriptionCVE.org

Inappropriate implementation in PreviewTab in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome for Android (prior to 150.0.7871.47) via the PreviewTab feature allows remote attackers to misrepresent interface elements through a crafted HTML page. Successful exploitation requires high attack complexity - specifically, the attacker must convince a victim to perform particular UI gestures - limiting this to targeted rather than opportunistic attacks. No active exploitation or public proof-of-concept has been identified; the Chromium security team rates this as Low severity, consistent with its constrained CVSS 4.2 score.

Technical ContextAI

The vulnerability resides in Chrome's PreviewTab component on Android - a feature that renders a preview of a link's destination before the user fully navigates to it. CWE-451 (User Interface Misrepresentation of Critical Information) identifies the root cause as the component failing to adequately distinguish or validate the content it renders, allowing a specially crafted HTML page to manipulate the preview display in ways that misrepresent security-relevant information to the user. This class of flaw is particularly relevant in mobile contexts where reduced screen real estate and unfamiliar gesture-based interactions create higher user susceptibility to visual deception. The vulnerability is platform-scoped to Android; desktop and iOS Chrome are not referenced as affected. CPE and version scope are confirmed by EUVD as Chrome versions below 150.0.7871.47.

RemediationAI

Update Google Chrome on Android to version 150.0.7871.47 or later, as announced in the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome on Android typically receives updates automatically through the Google Play Store; users and administrators managing Android fleets should verify that auto-update policies are active and confirm the installed version reflects 150.0.7871.47 or higher. As a compensating control prior to patching, users can be advised to avoid engaging in unexpected or unsolicited UI gesture sequences when browsing untrusted content in Chrome, though this provides limited enforcement value in unmanaged environments. No workarounds that eliminate the attack surface without patching have been identified from available data.