What is the CVSS score of CVE-2026-14410?

CVE-2026-14410 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14410?

Yes, a patch is available for CVE-2026-14410. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14410

EUVD-2026-41158 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-07-01 Chrome

GHSA-c83p-9h6m-7f68

Information Disclosure Google Red Hat Suse

4.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

3.1 LOW

Renderer process compromise prerequisite elevates AC to H; PR:N retained as no target-system auth is required; I:L reflects UI spoofing only with no C or A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

2.8 LOW

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 17:26 vuln.today

CVSS changed

Jul 02, 2026 - 17:22 NVD

4.3 (MEDIUM)

CVE Published

Jul 01, 2026 - 22:21 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 22:21 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome's Skia graphics engine (versions prior to 150.0.7871.46) allows a remote attacker who has already compromised the renderer process to mislead users through a crafted HTML page. The attack requires renderer process compromise as a prerequisite, making this a chained exploit component rather than a standalone threat. EPSS at 0.18% (8th percentile) and absence from CISA KEV confirm no known active exploitation; Chromium's own team rated this Low severity.

Technical ContextAI

Skia is the open-source 2D graphics library embedded in Google Chrome responsible for rendering text, images, geometry, and UI elements across all platforms. CWE-451 ('User Interface Misrepresentation of Critical Information') identifies the root cause: the Skia rendering pipeline contains an inappropriate implementation that can be manipulated to misrepresent visual UI elements - such as browser chrome components, security indicators, or dialog boxes - when processing attacker-controlled HTML. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, with EUVD-2026-41158 narrowing the affected range to all Chrome releases below 150.0.7871.46. Because Skia operates within the renderer process sandbox, exploitation is gated behind a prior renderer compromise step.

RemediationAI

Update Google Chrome to version 150.0.7871.46 or later, which addresses this flaw per the vendor stable channel advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism will apply this patch automatically for most users; administrators should verify managed deployments have received the update via enterprise policy. No documented workarounds exist for this specific flaw. Because this vulnerability requires a prior renderer process compromise to reach, organizations should treat patching higher-severity renderer escape vulnerabilities included in the same Chrome release as the higher operational priority - eliminating the renderer compromise prerequisite effectively neutralizes this flaw as well. No compensating controls are available that would specifically block the Skia rendering path without disabling rendering functionality entirely.