CVE-2026-14072: Chrome SplitView UI Spoofing Vulnerability

Technical summary

CVE-2026-14072 stems from an inappropriate implementation in Chrome's SplitView component. The vulnerability falls under CWE-451 (User Interface (UI) Misrepresentation of Critical Information), meaning the underlying issue involves how the browser renders and isolates content boundaries in split-view layouts. An attacker can craft HTML that bypasses the visual separation Chrome intends between trusted browser UI and untrusted web content, creating a convincing spoofing attack. The CVSS 3.1 score of 4.3 reflects the attack's network accessibility and low complexity, offset by the requirement for user interaction and the limitation to integrity impact (no confidentiality or availability loss).

Business impact

UI spoofing attacks undermine user trust in the browser itself. Employees or customers could be socially engineered through fake login prompts, payment forms, or security warnings that appear to come from your organization or the browser vendor. While the vulnerability alone doesn't steal data or crash systems, successful exploitation can lead to credential theft, malware downloads, or fraudulent transactions. Organizations heavily reliant on Chrome for sensitive workflows face reputational and operational risk until users update.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are affected. This includes all stable, beta, and extended-release versions below that threshold. The vulnerability is specific to Chrome and does not affect other Chromium-based browsers unless they independently shipped the same flawed SplitView implementation. Organizations should verify their Chrome version distribution across endpoints to assess exposure.

Exploitability

The attack is moderately easy to execute: an attacker simply hosts a crafted HTML page and tricks or socially engineers a user into visiting it via email, ads, or other social vectors. No special privileges, authentication, or user-level software installation are required on the victim's system. However, exploitation depends entirely on user interaction—passive browsing of a legitimate site does not trigger the flaw. Real-world exploitation likelihood is elevated in targeted campaigns but lower in opportunistic attacks. The Chromium security team assigned this a 'Low' severity rating, suggesting the UI spoofing window or conditions are somewhat constrained, though the CVSS score of 4.3 reflects the practical risk.

Remediation

Update Chrome to version 150.0.7871.47 or later on all affected systems. Google typically ships security updates automatically; confirm that auto-update is enabled. For managed environments, push the patch through your endpoint management tools. Verify the update succeeded by checking chrome://version. There are no known workarounds; patching is the only mitigation.

Patch guidance

Verify your Chrome deployment mechanism (auto-update, managed updates via MDM, or manual distribution). Confirm that all endpoints are running 150.0.7871.47 or later. If using an Enterprise policy to delay updates, assess whether the spoofing risk justifies an exception for this patch. Prioritize user-facing systems and shared workstations where social engineering attacks are more likely to succeed. Test the update in a non-production environment first if your workflow permits, though this patch is low-risk from a stability perspective.

Detection guidance

Network-level detection is limited because the malicious content is served over normal HTTPS. Endpoint detection should focus on user reports of suspicious UI elements or unexpected prompts during web browsing. Log Chrome update status and version via your mobile device management (MDM) or endpoint detection and response (EDR) tool to ensure patch compliance. Monitor for phishing or social engineering campaigns that reference Chrome UI elements, which may signal attackers attempting to exploit this or related flaws. Consider user training on how to verify legitimate browser UI (e.g., checking the URL bar directly rather than relying on in-page warnings).

Why prioritize this

This vulnerability merits prompt patching but is not an emergency. The CVSS score of 4.3 and Chromium's 'Low' severity assessment reflect the constrained attack surface and reliance on user interaction. However, UI spoofing is a proven attack vector in real-world breaches, and Chrome's ubiquity means widespread exposure. Organizations should patch within their standard monthly or quarterly update window, prioritizing systems where users handle sensitive transactions or are frequent targets of social engineering. The lack of KEV status indicates no active in-the-wild exploitation has been detected at publication, reducing urgency.

Risk score, explained

The CVSS 3.1 score of 4.3 (Medium severity) balances several factors: the attack is network-based with low complexity and requires no special privileges (raising the base score), but it needs active user interaction to succeed and impacts only integrity (not confidentiality or availability), which moderates it. The vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N reflects these constraints. In practice, the risk depends on your environment: organizations where users visit untrusted sites or are regularly targeted by phishing campaigns face higher real-world risk than highly restricted, air-gapped environments.

Frequently asked questions