What is the CVSS score of CVE-2026-14144?

CVE-2026-14144 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-14144?

Yes, a patch is available for CVE-2026-14144. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14144

EUVD-2026-40831 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-5fg5-34jh-m6jp

Information Disclosure Google Red Hat Suse

4.2

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

vuln.today AI

4.2 MEDIUM

Network delivery with no auth aligns with PR:N/AV:N; AC:H and UI:R reflect mandatory gesture-based user interaction; no confidentiality breach, limited integrity/availability impact from UI spoofing only.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 02:44 vuln.today

CVSS changed

Jul 01, 2026 - 02:22 NVD

4.2 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.2

DescriptionCVE.org

Incorrect security UI in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome's Views component (versions prior to 150.0.7871.47) allows a remote attacker to misrepresent security-critical browser interface elements through a crafted HTML page. Exploitation requires convincing a target user to perform specific UI gestures, making the attack conditional on social engineering. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog; Google has released a patch as part of the stable channel update.

Technical ContextAI

The Chrome 'Views' toolkit is the cross-platform UI rendering layer responsible for drawing browser interface elements such as address bars, security lock icons, and permission prompts. CWE-451 (UI Misrepresentation of Critical Information) identifies the root cause: the Views component fails to correctly render security-critical UI elements under specific user gesture sequences, allowing an attacker-controlled HTML page to influence what the browser displays as trusted security indicators. The CVSS vector AV:N/AC:H/PR:N/UI:R/S:U confirms the vulnerability is network-delivered, requires no authentication, but demands specific user interaction and is non-trivially exploitable (AC:H). Chromium internally rated this vulnerability 'Low' severity, consistent with the constrained impact metrics (C:N/I:L/A:L).

RemediationAI

Update Google Chrome to version 150.0.7871.47 or later via the browser's built-in update mechanism or through enterprise deployment tooling. The stable channel update is documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Since exploitation requires convincing users to perform specific UI gestures on a malicious page, organizations that have not yet patched can reduce risk by enforcing security awareness training around suspicious UI behavior and restricting navigation to untrusted sites via proxy policy. Disabling JavaScript on untrusted domains (via enterprise policy or extensions) may reduce the attacker's ability to trigger the required UI gesture sequence, though this has significant usability trade-offs. No documented workaround fully eliminates the vulnerability without the vendor patch.