What is the CVSS score of CVE-2026-14135?

CVE-2026-14135 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14135?

Yes, a patch is available for CVE-2026-14135. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14135

EUVD-2026-40822 MEDIUM

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-7r54-w6p6-rv2x

Information Disclosure Google Red Hat Suse

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

vuln.today AI

4.2 MEDIUM

Renderer-process compromise is a substantial prerequisite that raises AC to H; no victim-side authentication required; impact is limited to UI spoofing with no availability component.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

2.8 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:08 vuln.today

CVSS changed

Jul 01, 2026 - 16:07 NVD

5.4 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 nvd

MEDIUM 5.4

DescriptionNVD

Insufficient validation of untrusted input in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome's Network component (versions prior to 150.0.7871.47) can be triggered by a remote attacker who has already compromised the renderer process, allowing browser UI elements to be faked via a crafted HTML page. This is a chained exploit - not a standalone flaw - requiring both prior renderer compromise and user interaction, which significantly constrains real-world risk. No public exploit code exists and no confirmed active exploitation has been recorded; EPSS at 0.18% (8th percentile) and Chromium's own 'Low' severity rating reinforce this assessment.

Technical ContextAI

The vulnerability resides in Chrome's Network component, the subsystem responsible for processing and routing network-level data through the browser. CWE-20 (Improper Input Validation) identifies the root cause as failure to adequately sanitize or validate untrusted input flowing from the network layer. Chromium's multi-process sandbox architecture normally isolates the renderer process from the privileged browser process; however, this flaw allows a compromised renderer to pass malformed data through the Network component in a way that manipulates browser UI - potentially spoofing address bar content, origin indicators, or security badges. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome builds prior to 150.0.7871.47 per EUVD-2026-40822.

RemediationAI

Update Google Chrome to version 150.0.7871.47 or later; this is the vendor-confirmed fix per the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism handles this automatically for most desktop deployments - verify the installed version at chrome://settings/help. For managed enterprise fleets using Chrome policy, push the update via Google Admin Console or your MDM solution. As a compensating control pending patch deployment, ensuring Chrome's site isolation (--site-per-process) remains enabled - the default on current stable builds - reduces the likelihood of renderer compromise, which is the prerequisite for this attack; disabling site isolation for performance would meaningfully increase exposure. No significant trade-offs apply to leaving site isolation enabled.