What is the CVSS score of CVE-2026-14134?

CVE-2026-14134 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14134?

Yes, a patch is available for CVE-2026-14134. Update the affected software to the latest version immediately.

Google Chrome Android CVE-2026-14134

EUVD-2026-40821 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-9q59-v74x-7cxm

Information Disclosure Google Red Hat

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network delivery via crafted HTML page, no privileges needed, mandatory user visit required, limited integrity impact via UI spoofing only, no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

0.0 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:12 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Autofill in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing via Google Chrome's Autofill implementation on Android (prior to 150.0.7871.47) allows remote unauthenticated attackers to misrepresent interface elements through a crafted HTML page, potentially deceiving users into disclosing sensitive input or taking unintended actions. The vulnerability is platform-specific to Android and carries a Chromium-internal severity of Low, consistent with its limited integrity-only impact and requirement for user interaction. No public exploit code or active exploitation has been identified at time of analysis, and EPSS probability sits at 0.17% (7th percentile), confirming minimal real-world threat pressure.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) describes flaws where a product presents information in a way that deceives the user about its true nature or origin. In this case, Chrome's Autofill subsystem on Android contains an inappropriate implementation that can be triggered by a crafted HTML page to display spoofed UI elements - such as false form labels, dropdown suggestions, or overlay prompts - that misrepresent what the user is interacting with. The CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) scopes the affected product broadly to Google Chrome but EUVD and the advisory confirm the Android-specific platform constraint. Autofill-related UI spoofing typically exploits the browser's trust relationship with native OS overlays or suggestion banners to present attacker-controlled content in a privileged-looking context.

RemediationAI

Upgrade Google Chrome on Android to version 150.0.7871.47 or later, which is confirmed to include the vendor-released patch per the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Updates can be applied through the Google Play Store. For environments where immediate patching is not feasible, compensating controls include disabling Autofill in Chrome Android settings (Settings > Autofill Services) to eliminate the vulnerable code path, at the trade-off of losing form-fill convenience. Network-layer controls are not effective for this vulnerability given that the attack surface is a crafted HTML page delivered via any web channel. Given the low severity and absence of active exploitation, normal patch cycle cadence is appropriate rather than emergency out-of-band remediation.