What is the CVSS score of CVE-2026-14139?

CVE-2026-14139 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14139?

Yes, a patch is available for CVE-2026-14139. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14139

EUVD-2026-40826 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-cx8v-3x43-439c

Information Disclosure Google Red Hat Suse

4.2

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

vuln.today AI

4.2 MEDIUM

Network-delivered via crafted page (AV:N); high complexity for required UI gesture engineering (AC:H); no attacker authentication needed (PR:N); active user gestures mandatory (UI:R); UI spoofing yields only limited integrity and availability impact with no confidentiality breach (C:N/I:L/A:L).

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 02:44 vuln.today

CVSS changed

Jul 01, 2026 - 02:22 NVD

4.2 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.2

DescriptionCVE.org

Inappropriate implementation in TabStrip in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome's TabStrip component prior to version 150.0.7871.47 allows a remote attacker to misrepresent tab or page identity through a crafted HTML page, contingent on convincing the victim to perform specific UI gestures. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L) places real-world risk in the lower tier: high attack complexity, mandatory user interaction, and no confidentiality impact combine to limit practical exploitation. No public exploit code exists and CISA has not added this to the KEV catalog, consistent with Google's own Low severity classification.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) identifies the root cause as a logic or rendering defect in the TabStrip - the horizontal bar in Chrome that displays open browser tabs. An 'inappropriate implementation' in this component suggests that the browser fails to correctly enforce visual boundaries between tab origins or security indicators under specific interaction conditions, allowing a crafted page to render spoofed tab UI elements. The affected product is Google Chrome desktop (all platforms implied by the stable-channel advisory) at versions below 150.0.7871.47. The Chromium issue tracker reference (issues.chromium.org/issues/514072495) may provide deeper technical detail not yet publicly disclosed.

RemediationAI

Upgrade Google Chrome to version 150.0.7871.47 or later, as documented in the Google Chrome stable-channel update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's built-in auto-update mechanism will deliver this patch automatically for most consumer and enterprise users; administrators using Google Admin Console or Chrome Browser Cloud Management should validate that 150.0.7871.47 is deployed across managed endpoints. Given the Low severity, the requirement for user-performed UI gestures, and the absence of known exploitation, this patch fits comfortably within normal patch cycle cadences rather than requiring emergency deployment. No specific workarounds are documented; partial mitigations such as user-awareness training to avoid engaging with suspicious tab interactions offer limited protection and should not substitute for patching.