What is the CVSS score of CVE-2026-14404?

CVE-2026-14404 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14404?

Yes, a patch is available for CVE-2026-14404. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14404

EUVD-2026-41157 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-07-01 Chrome

GHSA-68q2-f79g-5v77

Information Disclosure Google Red Hat Suse

6.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered PDF requires no attacker privileges; victim must open it (UI:R); impact is integrity-only spoofing with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 MEDIUM

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 14:52 vuln.today

CVSS changed

Jul 02, 2026 - 14:52 NVD

6.5 (None) 6.5 (MEDIUM)

CVE Published

Jul 01, 2026 - 22:21 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 22:21 cve.org

MEDIUM 6.5

DescriptionCVE.org

Inappropriate implementation in PDFium in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to perform UI spoofing via a crafted PDF file. (Chromium security severity: Medium)

AnalysisAI

UI spoofing via a crafted PDF file in Google Chrome's PDFium rendering engine allows a remote, unauthenticated attacker to visually mislead users into performing unintended actions or trusting falsified content. All Chrome versions prior to 150.0.7871.46 are affected. Exploitation requires the victim to open a malicious PDF - no special configuration is needed beyond default Chrome behavior. No public exploit identified at time of analysis, and CISA SSVC rates exploitation as none with partial technical impact.

Technical ContextAI

PDFium is the open-source PDF rendering library embedded in Google Chrome (and Chromium-derived browsers), responsible for parsing and displaying PDF files natively within the browser. The vulnerability is classified as CWE-451 (User Interface Misrepresentation of Critical Information), a root cause where the UI layer fails to accurately represent security-critical state to the user. An 'inappropriate implementation' in PDFium allows a specially crafted PDF to manipulate how Chrome renders or presents UI elements - such as security indicators, origin information, or dialog prompts - leading to spoofing. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop variants prior to 150.0.7871.46 across platforms.

RemediationAI

The primary fix is upgrading Google Chrome to version 150.0.7871.46 or later, which is confirmed as the patched stable channel release per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome typically auto-updates, but administrators managing enterprise deployments should verify update propagation via policy. As a compensating control while patching is pending, organizations can restrict or disable in-browser PDF rendering by configuring Chrome to download PDFs rather than open them inline (via the 'Download PDF files instead of automatically opening them in Chrome' setting in chrome://settings/content/pdfDocuments), which prevents PDFium from processing untrusted PDF files - this carries the trade-off of reduced user convenience and shifts risk to whatever external PDF viewer is used. Blocking untrusted PDF delivery at the email gateway or proxy layer is an additional network-level control.