What is the CVSS score of EUVD-2026-40828?

EUVD-2026-40828 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40828?

Yes, a patch is available for EUVD-2026-40828. Update the affected software to the latest version immediately.

Google Chrome Android EUVD-2026-40828

| CVE-2026-14141 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-wc77-8m9c-2wpc

Information Disclosure Google Red Hat Suse

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-served spoofing attack requiring only a page visit (UI:R); no privileges needed, no confidentiality or availability impact, limited integrity via UI deception only.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.4 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:37 vuln.today

CVSS changed

Jul 01, 2026 - 16:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

DescriptionCVE.org

Incorrect security UI in Document Picture-in-Picture in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Domain spoofing via incorrect security UI in Google Chrome's Document Picture-in-Picture feature on Android (prior to 150.0.7871.47) allows a remote attacker to deceive users about the origin of displayed content. By serving a crafted HTML page, an attacker can cause Chrome on Android to render a misleading security UI - misrepresenting the domain shown to the user. No public exploit has been identified at time of analysis, EPSS sits at 0.18% (8th percentile), and SSVC rates exploitation as none, making this a low operational priority despite its network-accessible attack vector.

Technical ContextAI

Document Picture-in-Picture (Document PiP) is a browser API that allows web content to be displayed in an always-on-top floating window, separate from the main browsing context. CWE-451 (User Interface Misrepresentation of Critical Information) identifies the root cause: the security UI around this PiP window fails to correctly reflect the actual document origin, enabling an attacker-controlled page to mislead the victim about which domain is being displayed. This is a client-side UI integrity failure, not a memory-safety or code-execution class flaw. The affected CPE context is Google Chrome for Android, versions prior to 150.0.7871.47, as confirmed by the EUVD entry EUVD-2026-40828.

RemediationAI

Update Google Chrome on Android to version 150.0.7871.47 or later - this is the vendor-confirmed fixed release per the Google Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome on Android updates automatically via the Google Play Store; administrators managing enterprise Android fleets via EMM/MDM should verify Chrome is not pinned below this version. If immediate patching is not possible, a compensating control would be to advise users to distrust any floating PiP windows that request sensitive input or display credential prompts, since the spoofed domain indicator could be used for phishing - though this is a behavioral control with no enforcement mechanism. No feature-disable workaround for Document PiP is exposed to end users in standard Chrome builds.