What is the CVSS score of CVE-2026-14140?

CVE-2026-14140 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14140?

Yes, a patch is available for CVE-2026-14140. Update the affected software to the latest version immediately.

Google Chrome Android CVE-2026-14140

EUVD-2026-40827 MEDIUM

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-8gmg-rgvj-xvjj

Information Disclosure Google Red Hat

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted HTML; no attacker privileges needed; mandatory user navigation (UI:R); impact confined to UI integrity deception with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.4 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:11 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome for Android prior to 150.0.7871.47 enables remote unauthenticated attackers to deceive users about page origin or content through insufficient validation of untrusted input in the browser's Input component. Exploitation requires user interaction - a victim must visit a crafted HTML page - and produces only limited integrity impact (visual deception), with no code execution or data exfiltration capability. No public exploit identified at time of analysis; EPSS sits at 0.18% (8th percentile) and CISA SSVC confirms zero observed exploitation, consistent with Google's own 'Low' severity classification for this Chromium issue.

Technical ContextAI

The flaw resides in Chrome's Input handling subsystem on Android and is classified under CWE-20 (Improper Input Validation), meaning the browser fails to adequately sanitize or reject attacker-controlled content before using it to render UI elements. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers the Google Chrome application broadly, but the description explicitly scopes the vulnerability to the Android platform. The exploitation surface involves a crafted HTML page that manipulates how Chrome presents input-related UI - potentially spoofing address bar content, dialog boxes, security indicators, or form elements - to mislead the user about the identity or trustworthiness of the page. The Chromium bug tracker entry (issues.chromium.org/issues/514072607) is the upstream technical reference for the root-cause fix.

RemediationAI

Update Google Chrome on Android to version 150.0.7871.47 or later; this is the vendor-released patch confirmed by the stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Updates can be applied through the Google Play Store or via Chrome's built-in update mechanism (Settings > About Chrome). If immediate updating is not possible, users should avoid following links from untrusted or unsolicited sources, since the attack vector requires the victim to navigate to a crafted HTML page - this reduces exposure but does not eliminate it and introduces user friction. No configuration-level workaround exists because the flaw is in the browser's core input processing path. Enterprise administrators managing Android fleets via EMM solutions such as Google Workspace or Microsoft Intune should push the Chrome update through managed app deployment rather than relying on user-initiated updates.