What is the CVSS score of CVE-2026-14136?

CVE-2026-14136 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14136?

Yes, a patch is available for CVE-2026-14136. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-14136

EUVD-2026-40823 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-c53h-xmgp-j2hj

Information Disclosure Google Apple Red Hat

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page requiring victim navigation (UI:R, PR:N); integrity limited to UI misrepresentation with no confidentiality or availability impact (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:11 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome for iOS prior to 150.0.7871.47 allows a remote, unauthenticated attacker to misrepresent browser interface elements by delivering a crafted HTML page to a victim who visits it. Rooted in CWE-451 (UI Misrepresentation of Critical Information), the flaw arises from insufficient validation of untrusted HTML input in the iOS-specific Chrome rendering pipeline, enabling manipulation of trust signals such as address bar display or security indicators. No public exploit identified at time of analysis; EPSS at 0.18% (8th percentile) and SSVC Exploitation: none confirm negligible current threat actor interest.

Technical ContextAI

CWE-451 describes vulnerabilities where an application presents UI chrome elements - address bars, origin indicators, security dialogs - in a manner that misrepresents the actual document origin or security state to the user. Chrome for iOS operates on Apple's UIKit/WebKit integration layer rather than the desktop Blink stack, and insufficient input validation in this layer can allow attacker-controlled HTML or JavaScript to influence rendered UI elements beyond the content area. The CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers Google Chrome broadly; the iOS-platform scope is derived from the CVE description and the Chromium issue tracker entry at https://issues.chromium.org/issues/514068611 rather than from the CPE string itself. The integrity impact is bounded to UI deception - no memory corruption, sandbox escape, or code execution pathway is implied by the CWE or CVSS vector.

RemediationAI

Update Chrome for iOS to version 150.0.7871.47 or later via the Apple App Store; this is the vendor-released patch as confirmed by the Chrome Releases advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Organizations managing iOS device fleets through MDM (Jamf, Microsoft Intune, Apple Business Manager) should push a minimum version policy for Chrome to enforce the update. No documented workaround exists for this specific validation flaw. Partially restricting JavaScript execution via Content Security Policy or enterprise browser policy would reduce spoofing surface but would break broad web functionality and is not recommended as a compensating control. Given the user-interaction requirement (UI:R), reinforcing user awareness about scrutinizing browser address bars and security indicators provides marginal complementary defense.