What is the CVSS score of EUVD-2026-41163?

EUVD-2026-41163 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-41163?

Yes, a patch is available for EUVD-2026-41163. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-41163

| CVE-2026-14381 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-07-01 Chrome

GHSA-r2mf-x5c6-qff9

Information Disclosure Google Red Hat Suse

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page requiring active user interaction with install prompt (UI:R); spoofing yields only low integrity impact with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

CVSS changed

Jul 02, 2026 - 18:22 NVD

4.3 (MEDIUM) 6.5 (MEDIUM)

Analysis Generated

Jul 02, 2026 - 17:25 vuln.today

CVSS changed

Jul 02, 2026 - 17:22 NVD

4.3 (MEDIUM)

CVE Published

Jul 01, 2026 - 22:21 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 22:21 cve.org

MEDIUM 4.3

DescriptionNVD

Incorrect security UI in WebAppInstalls in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome's WebAppInstalls component (versions prior to 150.0.7871.46) enables remote attackers to misrepresent security indicators during Progressive Web App installation prompts via a crafted HTML page. The incorrect security UI (CWE-451) can deceive users into believing they are installing a legitimate, trusted application when they are not, resulting in a low-integrity impact. EPSS is 0.18% (8th percentile), no public exploit code exists, and this vulnerability has not been added to CISA KEV, indicating minimal active exploitation risk at time of analysis.

Technical ContextAI

The vulnerability resides in Chrome's WebAppInstalls subsystem, which governs the Progressive Web App (PWA) installation flow - including the security dialogs and origin indicators presented to users when a web app requests installation. CWE-451 (User Interface Misrepresentation of Critical Information) identifies the root cause: the UI fails to correctly render or enforce the security context of the installing origin, allowing attacker-controlled content to manipulate what the user perceives as trustworthy. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all desktop platform variants prior to version 150.0.7871.46. The Chromium bug tracker issue 407283320 references the internal fix.

RemediationAI

Upgrade Google Chrome to version 150.0.7871.46 or later, which is confirmed as the patched release per the vendor advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome updates automatically by default; users and administrators should verify the installed version via Help > About Google Chrome and force an update if needed. For enterprise environments where immediate patching is constrained, consider disabling PWA installation capabilities via Chrome enterprise policy (setting WebAppInstallForceList or blocking installs through group policy), noting this trade-off prevents legitimate PWA adoption. No documented workarounds short of patching have been identified by the vendor.