What is the CVSS score of CVE-2026-14138?

CVE-2026-14138 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14138?

Yes, a patch is available for CVE-2026-14138. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14138

EUVD-2026-40825 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-45j8-gm4m-hfx8

Information Disclosure Google Microsoft Red Hat Suse

4.2

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

vuln.today AI

3.1 LOW

UI spoofing with no data disclosure and no service disruption warrants A:N; all other metrics align with network-delivered, user-gesture-dependent, low-integrity-impact spoofing.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 02:44 vuln.today

CVSS changed

Jul 01, 2026 - 02:22 NVD

4.2 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.2

DescriptionCVE.org

Inappropriate implementation in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome's WebAppInstalls component on Windows (versions prior to 150.0.7871.47) enables a remote attacker to misrepresent the browser interface by luring a user into performing specific UI interaction gestures on a crafted HTML page. The flaw is Windows-platform-specific and rooted in an inappropriate implementation of the Progressive Web App installation UI flow. Google rates this Low severity; no public exploit identified at time of analysis, and EPSS data is not present in the provided intelligence, but the CVSS 4.2 score and required high-complexity user interaction significantly limit real-world risk.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) covers flaws where the UI presents information in a misleading or incorrect way, causing users to take unintended actions or be deceived about the nature of an operation. The affected component is WebAppInstalls - the subsystem in Chromium responsible for the Progressive Web App (PWA) installation flow, including the prompts, dialogs, and visual affordances presented to the user during installation. The inappropriate implementation on Windows specifically suggests a platform-divergent rendering or event-handling path that allows an attacker-controlled page to influence or spoof the installation UI. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L) is consistent with a browser-delivered UI manipulation attack that requires non-trivial user engagement beyond passive browsing.

RemediationAI

Update Google Chrome on Windows to version 150.0.7871.47 or later; this is the vendor-confirmed fixed release per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's automatic update mechanism will deliver this update to most managed and consumer endpoints without manual intervention - verify auto-update is not blocked by enterprise policy. As a compensating control for environments that cannot immediately patch, consider restricting access to untrusted external websites via web filtering or browser isolation, which reduces exposure to crafted HTML pages. Disabling PWA installation via enterprise policy (e.g., WebAppInstallForceList or restricting the WebAppInstalls feature) could eliminate the specific attack surface at the cost of losing PWA functionality for end users. No workaround eliminates the underlying flaw.