What is the CVSS score of CVE-2026-14154?

CVE-2026-14154 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-14154?

Yes, a patch is available for CVE-2026-14154. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14154

EUVD-2026-40841 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-x3fv-7p2c-6vv3

Information Disclosure Google Red Hat Suse

4.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

3.1 LOW

UI:R corrects the supplied vector's UI:N - extension installation is explicit user interaction; A:N applies as UI spoofing carries no credible availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

0.0 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 02:45 vuln.today

CVSS changed

Jul 01, 2026 - 02:22 NVD

4.8 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.8

DescriptionCVE.org

Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome's DevTools component allows an attacker to misrepresent critical interface information to users who have been socially engineered into installing a malicious Chrome Extension. Affected versions are all Chrome releases prior to 150.0.7871.47. The flaw stems from an inappropriate implementation (CWE-451) in DevTools, enabling an extension to manipulate how DevTools renders UI elements - potentially deceiving developers or power users into trusting falsified debugging output or security indicators. No public exploit code has been identified at time of analysis, and this vulnerability is not in the CISA KEV catalog.

Technical ContextAI

The vulnerability resides in Google Chrome's DevTools subsystem, the built-in browser developer toolset accessible via F12 or right-click inspect. CWE-451 (User Interface Misrepresentation of Critical Information) identifies the root cause as the DevTools UI failing to adequately isolate or validate rendering influence from Chrome Extensions, allowing extension-controlled content or UI artifacts to spoof legitimate DevTools panels or indicators. Chrome Extensions have defined permission scopes but the inappropriate implementation here permits a crafted extension to inject or manipulate DevTools UI elements beyond its intended boundary. Affected CPE covers Chrome versions below 150.0.7871.47 across desktop platforms as reported by EUVD.

RemediationAI

Update Google Chrome to version 150.0.7871.47 or later, which contains the vendor-released patch. The advisory is available at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome auto-updates by default; administrators in managed enterprise environments should verify deployment via Google Admin Console or endpoint management tooling. As a compensating control prior to patching, organizations can enforce Chrome Extension allow-listing via enterprise policy (ExtensionInstallAllowlist / ExtensionInstallBlocklist) to prevent installation of unapproved extensions - this directly addresses the required attack precondition and has no meaningful trade-off for managed environments. Disabling DevTools access for non-developer user populations via the DeveloperToolsAvailability policy further limits exposure, though this impacts legitimate developer workflows.