What is the CVSS score of CVE-2026-14130?

CVE-2026-14130 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14130?

Yes, a patch is available for CVE-2026-14130. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14130

EUVD-2026-40817 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-crcp-w54f-c64v

Information Disclosure Google Red Hat Suse

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered spoofing requires active user navigation (UI:R); no attacker auth needed; impact is integrity-only (misleading Omnibox display) with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

0.0 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:37 vuln.today

CVSS changed

Jul 01, 2026 - 16:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

DescriptionNVD

Incorrect security UI in Omnibox in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome's Omnibox (address bar) prior to version 150.0.7871.47 allows a remote attacker to misrepresent origin or security indicators to a victim via a crafted HTML page. Rooted in CWE-451 (misrepresentation of critical security information), the flaw can enable phishing or origin-confusion attacks by deceiving users into trusting a false domain indicator. No public exploit code exists, CISA SSVC rates exploitation as none, and the EPSS score of 0.18% (8th percentile) confirms this is low-priority outside phishing-sensitive deployments.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) describes a class of flaws where a browser fails to correctly render or protect security-critical UI elements that users rely upon to make trust decisions. Chrome's Omnibox is the unified address and search bar that serves as the primary trust anchor for web origin verification - users inspect it to confirm they are on the intended site before submitting credentials or sensitive data. A defect in how Chrome renders URL or security indicator state within the Omnibox can be exploited through a crafted HTML page to display a misleading origin. Based on the EUVD affected-version entry ('Chrome 150.0.7871.47 <150.0.7871.47'), all desktop Chrome releases on Windows, macOS, and Linux prior to 150.0.7871.47 are in scope. The Chromium security team classifies this as Low severity internally, consistent with the limited I:L integrity impact.

RemediationAI

Update Google Chrome to version 150.0.7871.47 or later - this is the vendor-confirmed fix per the Stable Channel Update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's built-in updater (Settings → Help → About Google Chrome) will apply this automatically in most deployments; enterprise environments should push the update via group policy or their browser management platform. No documented workaround exists for the Omnibox rendering defect itself. In environments where patching is delayed, compensating controls are limited but include user training to verify URLs through secondary means such as bookmarks or typed navigation rather than trusting the Omnibox display, and deployment of phishing-resistant MFA to limit the downstream impact if a user is deceived. These controls do not remediate the vulnerability and carry no technical side effects.