What is the CVSS score of EUVD-2026-40801?

EUVD-2026-40801 has a contested CVSS base score of 7.5 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-40801?

Google Chrome for Android before version 150.0.7871.47 contains a UI spoofing vulnerability that could deceive users into installing unauthorized applications or interacting with fabricated browser…. A patch is available.

How to fix or mitigate EUVD-2026-40801?

Within 24 hours, inventory Android devices in your environment running Chrome and identify any mobile device management (MDM) capabilities for coordinated deployment. Within 7 days, push Chrome version 150.0.7871.47 or later to managed devices via MDM, or distribute update notifications to unmanaged users. Within 30 days, verify deployment completion rates and conduct user awareness training on app installation prompts and downloads from untrusted sources.

Google Chrome EUVD-2026-40801

| CVE-2026-14114 HIGH

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-jf6g-r5j3-qf84

Information Disclosure Google Red Hat

High

Disputed · 7.5 Vendor: google

Severity by source

Sources disagree (Low–High)

Vendor (google) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

3.3 LOW

Description specifies a local attacker delivering a malicious file the user must open, so AV:L and UI:R; UI spoofing is limited integrity impact (I:L), no C or A.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

2.8 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:13 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 7.5

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to perform UI spoofing via a malicious file. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome for Android before 150.0.7871.47 lets a local attacker misrepresent browser interface elements through the WebAppInstalls component using a malicious file. The flaw (CWE-451) requires a crafted file to be opened on the device and could deceive users into trusting spoofed content or install prompts. Google rates the Chromium security severity as Low, no public exploit has been identified, and EPSS is negligible at 0.11%.

Technical ContextAI

The vulnerability lies in Chrome's WebAppInstalls feature on Android, the subsystem responsible for handling Progressive Web App / web app installation flows. The root cause is CWE-451 (User Interface Misrepresentation of Critical Information), meaning the browser renders or attributes UI elements - such as install dialogs, origin indicators, or app metadata - in a way that does not accurately reflect the underlying source. By supplying a malicious file that is processed through this install path, an attacker can cause the UI to display misleading information. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* on the Android platform specifically; desktop channels are not implicated by the description.

RemediationAI

Vendor-released patch: update Google Chrome for Android to 150.0.7871.47 or later via the Google Play Store or managed enterprise deployment (see the Chrome release advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html). Because the attack requires a malicious file to be opened on the device, an effective compensating control until update is to avoid opening untrusted files in Chrome and to restrict sideloading of files from unknown sources; enforcing managed Chrome auto-updates through Google Play or an MDM removes user-driven update lag. There is no server-side toggle to disable WebAppInstalls independently, so patching remains the primary and cleanest fix; the trade-off of the file-hygiene control is that it depends on user behavior and does not eliminate the underlying spoofing logic.