What is the CVSS score of CVE-2026-14143?

CVE-2026-14143 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14143?

Yes, a patch is available for CVE-2026-14143. Update the affected software to the latest version immediately.

Google Chrome iOS CVE-2026-14143

EUVD-2026-40830 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-h865-62xx-m869

Information Disclosure Google Apple Red Hat

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered UI spoofing requires active user interaction (UI:R); no credential exposure or system access means C:N/A:N, with only minor integrity impact from misleading display.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:10 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Incorrect security UI in Passwords in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome's Passwords feature on iOS (versions prior to 150.0.7871.47) enables remote attackers to manipulate the presentation of security-critical password UI elements via a specially crafted HTML page. Users who visit a malicious page in Chrome on iOS may see misleading security indicators or spoofed password dialogs, potentially deceiving them into unintended credential interactions. No public exploit identified at time of analysis; EPSS is 0.18% (8th percentile), and SSVC confirms no observed exploitation - risk is real but low-priority relative to the broader threat landscape.

Technical ContextAI

The vulnerability is rooted in CWE-451 (User Interface Misrepresentation of Critical Information), a class of flaw where the browser fails to enforce correct rendering boundaries between attacker-controlled content and trusted security UI chrome - specifically Chrome's built-in Passwords manager interface on iOS. Affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all Chrome versions before 150.0.7871.47 on iOS. The iOS platform context is significant: unlike desktop Chrome, iOS rendering and UI overlay behaviors differ due to WebKit constraints and the platform's sandboxing model, which may contribute to the incorrect security UI rendering. The Passwords feature surfaces credential autofill prompts and security warnings that, if spoofed, could undermine user trust signals and phishing defenses built into the browser.

RemediationAI

Update Google Chrome on iOS to version 150.0.7871.47 or later, which is confirmed to contain the vendor-released patch per the Chrome Releases advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Users should update via the Apple App Store. No workaround is practical for end users since the flaw is in browser-internal UI rendering rather than a configurable feature. Organizations managing iOS device fleets via MDM can enforce minimum Chrome version policies as a compensating control until devices are updated, though this does not remediate the underlying flaw. Disabling Chrome's Passwords/autofill feature in enterprise policy would remove the vulnerable UI surface entirely but trades off usability significantly.