Skip to main content

Google Chrome CVE-2026-14138

| EUVDEUVD-2026-40825 MEDIUM
User Interface (UI) Misrepresentation of Critical Information (CWE-451)
2026-06-30 chrome-cve-admin@google.com GHSA-45j8-gm4m-hfx8
Information Disclosure Microsoft Google Suse
4.2
CVSS 3.1 · Vendor: google
Share

Severity by source

Vendor (google) PRIMARY
4.2 MEDIUM
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
vuln.today AI
3.1 LOW

UI spoofing with no data disclosure and no service disruption warrants A:N; all other metrics align with network-delivered, user-gesture-dependent, low-integrity-impact spoofing.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low

Lifecycle Timeline

4
Analysis Generated
Jul 01, 2026 - 02:44 vuln.today
CVSS changed
Jul 01, 2026 - 02:22 NVD
4.2 (MEDIUM)
CVE Published
Jun 30, 2026 - 23:17 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 30, 2026 - 23:17 cve.org
MEDIUM 4.2

DescriptionCVE.org

Inappropriate implementation in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome's WebAppInstalls component on Windows (versions prior to 150.0.7871.47) enables a remote attacker to misrepresent the browser interface by luring a user into performing specific UI interaction gestures on a crafted HTML page. The flaw is Windows-platform-specific and rooted in an inappropriate implementation of the Progressive Web App installation UI flow. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Craft malicious HTML page abusing WebAppInstalls
Delivery
Host page on attacker-controlled server
Exploit
Lure Windows Chrome user to page via phishing or malvertising
Execution
Manipulate user into performing specific UI gesture sequence
Persist
Trigger inappropriate WebAppInstalls UI rendering
Impact
User presented with spoofed interface, takes unintended action
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the target to be running Google Chrome on Windows (the vulnerability is platform-specific to Windows); Chrome on macOS, Linux, or mobile platforms is not stated to be affected. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.2 score (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L) correctly captures the low-to-moderate real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker hosts a crafted HTML page designed to abuse the Chrome WebAppInstalls UI flow and socially engineers a target Windows user to visit the page and perform specific UI interactions - for example, clicking through a fake installation prompt or interacting with overlapping UI elements. Through the inappropriate WebAppInstalls implementation, the browser renders a spoofed interface element, causing the user to believe they are taking one action (e.g., dismissing a dialog) while actually triggering a different one, resulting in limited unintended integrity impact.
Remediation Update Google Chrome on Windows to version 150.0.7871.47 or later; this is the vendor-confirmed fixed release per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-451 – User Interface (UI) Misrepresentation of Critical Information

View all
CVE-2025-8043 CRITICAL POC
9.8
CVE-2024-55889 HIGH POC
7.2
CVE-2025-7021 MEDIUM POC
6.5
CVE-2022-2800 MEDIUM POC
6.1
CVE-2026-0907 CRITICAL
9.8
CVE-2026-0906 CRITICAL
9.8
CVE-2026-2634 CRITICAL
9.8
CVE-2016-9467 MEDIUM POC
5.3

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Package Hub 15 SP7 Fixed
openSUSE Tumbleweed Fixed
SUSE Package Hub 15 SP7 Affected

Share

CVE-2026-14138 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy