CVE-2026-14077: Chrome macOS Omnibox Spoofing Vulnerability – Patch Guide

Technical summary

CVE-2026-14077 is an implementation flaw in Chromium's Select element handling on macOS. The vulnerability permits Omnibox spoofing through crafted HTML, allowing remote attackers to display arbitrary content in the URL bar without proper user consent or warning. The issue is classified as CWE-451 (User Interface Inconsistency) and affects Chrome versions prior to 150.0.7871.47 on macOS. The Chromium project assigned this a Low severity rating internally, though the CVSS 3.1 score of 4.3 reflects the integrity impact when users cannot reliably trust the address bar to confirm site identity.

Business impact

The primary risk is phishing and social engineering at scale. If attackers can reliably spoof the Omnibox, users lose a critical visual cue for validating site legitimacy before entering credentials or sensitive data. Organizations with users on affected macOS systems face increased exposure to credential harvesting, especially if staff rely on the address bar as a phishing defense. The impact is amplified in sectors where URL verification is part of security awareness training (finance, healthcare, government). Attackers do not gain system access or data exfiltration directly; the vulnerability is a vector for downstream attacks.

Affected systems

Google Chrome on macOS versions prior to 150.0.7871.47 are affected. Both the Chrome browser and the underlying macOS platform are listed as vendors, reflecting that the issue manifests in Chrome's macOS implementation. Users on current versions of macOS running older Chrome builds are at risk. Windows and Linux Chrome users are not affected by this specific flaw.

Exploitability

Exploitation requires user interaction—the victim must visit an attacker-controlled webpage. No authentication, elevated privileges, or local access is needed; the attack occurs over the network from an unauthenticated, remote position. The low complexity means standard HTML and JavaScript suffice to trigger the issue. However, the attack's success depends on convincing users to click a link and trust the spoofed Omnibox, making it practical but not autonomously triggerable. The vulnerability is not listed in the Known Exploited Vulnerabilities (KEV) catalog, suggesting no active in-the-wild exploitation has been formally documented at this time.

Remediation

Update Chrome to version 150.0.7871.47 or later. Google has patched the Select element implementation to prevent Omnibox spoofing. Users should enable automatic Chrome updates to receive the fix without manual intervention. Organizations managing Chrome deployments should prioritize this update for macOS systems, especially those in user-facing or high-phishing-risk roles.

Patch guidance

Google Chrome on macOS should be updated to version 150.0.7871.47 or later. Verify the installed Chrome version by navigating to Chrome menu > About Google Chrome, which will automatically check for and install available updates. For managed deployments, confirm that your Chrome update policy (via enterprise policy, Mobile Device Management, or similar) is configured to push this version or later to all macOS endpoints. Test the update in a limited environment before broad rollout if your organization has compatibility validation requirements.

Detection guidance

Monitor Chrome version reporting across macOS systems to identify instances below 150.0.7871.47. Endpoint management tools, mobile device management platforms, and browser inventory solutions can flag outdated Chrome builds. Web filters may detect attempts to host or distribute exploits targeting this vulnerability, though the attack surface is inherently user-centric (a malicious webpage). User reports of address bar inconsistencies or inability to verify site URLs during browsing could signal exploitation attempts in the wild. No server-side or network-layer detection signature is applicable; focus should be on patching and user education.

Why prioritize this

While Chromium's internal severity is Low, the CVSS 4.3 (Medium) score reflects real user-facing integrity risk. Omnibox spoofing directly undermines a core defense against phishing—visual URL verification. For organizations with strict phishing prevention policies or user populations in high-risk roles, this is a higher-priority patch than the numeric score alone suggests. Absence from the KEV catalog means urgency is moderate, not critical, but the attack vector (remote, network-accessible) and reliance on visual trust make it a vulnerability security leaders should address within standard patch cycles.

Risk score, explained

The CVSS 3.1 score of 4.3 is derived from: network-accessible attack vector (AV:N), low complexity (AC:L), no privilege requirement (PR:N), and required user interaction (UI:R). The impact is limited to integrity (I:L)—the user sees false information in the Omnibox—with no confidentiality or availability impact. The score reflects that while the attack is easy to execute remotely, the actual harm depends on downstream user decisions and is not catastrophic at the OS or browser level. The Medium severity rating acknowledges the phishing risk without overstating system compromise potential.

Frequently asked questions