CVE-2026-14026: Chrome SplitView UI Spoofing Vulnerability

Technical summary

The vulnerability stems from an incorrect security UI implementation in Chrome's SplitView component. CWE-451 (User Interface (UI) Misrepresentation of Critical Information) captures the root cause: the security UI fails to properly represent the true state of the browser interface, creating a window for spoofing attacks. The attack vector is network-based and requires user interaction—specifically, the victim must perform UI gestures (such as dragging, clicking, or swiping in certain ways) on attacker-controlled HTML content. The flaw affects the integrity of the security interface layer, allowing pixel-perfect mimicry of legitimate UI elements that could convince users to take unintended actions.

Business impact

Organizations where employees browse the web using Chrome could face increased risk of credential theft, malware downloads, or phishing success through UI spoofing. An attacker hosting a weaponized site could display a fake login prompt that appears to come from a trusted service, or create a convincing overlay that mimics a security update notification. The attack requires user interaction and social engineering skill to be effective, which limits broad-scale impact but raises targeted attack risk. Financial services, healthcare, and high-profile corporate users are potential targets, as are general users in phishing campaigns that exploit UI confusion to bypass normal security instincts.

Affected systems

Google Chrome prior to version 150.0.7871.47 on Windows, macOS, and Linux is affected. The vulnerability affects the cross-platform SplitView implementation, so users on any supported OS running an unpatched Chrome build are exposed. This includes Chromium-based browsers and distributions that bundle or track Chromium's codebase, though official patch availability depends on each vendor's update cycle.

Exploitability

Exploitability is moderate and hinges on user interaction. An attacker must convince or socially engineer a user to visit a malicious webpage and then perform specific UI gestures—such as dragging, resizing, or interacting with the SplitView panel in a deliberate way. The attack is not automatic; passive browsing of the page is insufficient. This requirement for deliberate user action makes mass exploitation unlikely, but targeted attacks against specific users, employees, or via convincing social engineering are entirely feasible. No public exploit code appears to be in widespread use, and the vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Chromium-based browsers should confirm their vendor has integrated this fix into their release cycle. For organizations unable to patch immediately, education on avoiding suspicious interactive gestures on untrusted sites, disabling JavaScript in high-risk scenarios, or using browser sandboxing can reduce risk. Endpoint detection should flag unexpected UI overlay behaviors or unusual SplitView manipulation.

Patch guidance

Google has released Chrome 150.0.7871.47 and later versions containing the security UI fix. Organizations should prioritize updating within 2–4 weeks as part of normal patch cycles. Verify your Chrome version at chrome://version/. Enterprise deployments using managed Chrome updates should ensure their update policies are active and unblocked. Users on older Chrome release channels (extended support, ESR equivalents if available from their Chromium distributor) should contact their vendor for timing. Test the patch in a non-production environment if you maintain custom Chromium builds.

Detection guidance

Monitor for attempted execution of JavaScript or HTML injection payloads that manipulate SplitView panels or attempt to overlay fake security UI elements. Web application firewalls can flag requests containing payloads that interact with frame-splitting or panel-resizing APIs. Endpoint detection and response (EDR) solutions should alert on unusual browser processes spawning child windows with mismatched UI hierarchies. In browser logs, look for non-standard ContentScript executions or ServiceWorker registrations that modify the DOM during SplitView operations. User reports of strange overlays, duplicate address bars, or 'stuck' panel behavior should be investigated as possible exploitation attempts.

Why prioritize this

This vulnerability merits timely but not emergency patching. It requires user interaction, social engineering, and deliberate UI gestures—constraints that prevent automated, worm-like spread. However, the CVSS 4.2 score reflects both integrity impact (the false UI) and a minor availability angle (user confusion leading to system misuse). Targeted attacks on high-value individuals or credential-harvesting campaigns are realistic threats. Mid-market and enterprise organizations should patch within their standard 30-day cycle; consumer users should update at their next opportunity.

Risk score, explained

The CVSS:3.1 vector (4.2/MEDIUM) reflects: AV:N (network-reachable attack surface), AC:H (high attack complexity due to required UI gestures), PR:N (no authentication needed), UI:R (user interaction required), S:U (attack scope unchanged), C:N (no confidentiality loss), I:L (low integrity impact—the UI is spoofed but core data is not exposed), and A:L (low availability impact—the user's browser is confused but not crashed). The score appropriately captures a real but limited threat: the flaw enables deception, not data exfiltration or code execution, and success depends on victim cooperation and attacker skill.

Frequently asked questions