CVE-2026-14080: Chrome Android Navigation Bypass Vulnerability—Patch Guidance

Technical summary

CVE-2026-14080 stems from insufficient input validation in Chrome's TabSwitcher module on Android. The vulnerability allows a remote, unauthenticated attacker to circumvent navigation restrictions through malicious network traffic. The attack vector is network-based with low complexity, and while user interaction is required, the barrier to exploitation is minimal. The flaw is classified under CWE-20 (Improper Input Validation), indicating the root cause is inadequate sanitization of untrusted data before it influences navigation decisions. Chromium's internal severity assessment rated this as Low, though the CVSS 3.1 score of 4.3 reflects the moderate scope when user interaction is factored in.

Business impact

Navigation bypass vulnerabilities in mobile browsers can enable phishing attacks, forced redirection to malicious sites, or circumvention of parental controls and enterprise mobile device management policies. On Android devices, where Chrome is the dominant browser, this could affect a significant user base. Organizations managing Android fleets via MDM solutions may find their navigation policies undermined. The integrity impact is limited—an attacker can redirect users but cannot steal credentials or execute code—making this a medium-priority issue for most enterprises but potentially high-priority for those with strict device governance requirements.

Affected systems

Google Chrome on Android prior to version 150.0.7871.47 is affected. The vulnerability does not impact Chrome on other platforms (Windows, macOS, Linux, iOS). Android devices running affected Chrome versions are susceptible, with exposure proportional to device usage patterns and network exposure to potential attackers.

Exploitability

Exploitation requires no special privileges or authentication. The attacker must be able to send malicious network traffic to the victim, meaning they must be positioned on the network path (e.g., compromised Wi-Fi, network-level compromise) or trick a user into visiting a malicious website that triggers the flaw. User interaction is necessary—passive attacks are not viable. The low technical complexity suggests an attacker with moderate capability can craft exploit traffic, though Chromium has not disclosed public exploit code. The vulnerability is not currently tracked in the CISA KEV catalog, indicating limited or no evidence of in-the-wild exploitation at publication.

Remediation

Update Google Chrome on Android to version 150.0.7871.47 or later. Chrome's auto-update mechanism on Android typically rolls out new versions within days to weeks of release; users can manually check for updates via the Google Play Store. No workarounds or configuration changes mitigate the flaw—patching is the only remediation path.

Patch guidance

Verify Chrome version on Android devices by navigating to Settings > About Chrome, which will display the current version and automatically check for updates. Organizations managing Android devices via MDM should push the Chrome update through their mobile device management platform if Chrome is deployed as a managed app, or enable auto-updates to ensure timely deployment of version 150.0.7871.47 or later. End-users should enable automatic updates for Google Play Store apps if not already enabled (System Settings > Apps > Google Play Store > Settings > Auto-update apps).

Detection guidance

Direct detection of exploitation attempts is difficult without access to Chrome's internal logs or network-level traffic inspection, as the attack manifests as navigation to an unexpected page. Network detection approaches include monitoring for HTTP/HTTPS redirects from unexpected hosts or observing users suddenly accessing pages inconsistent with their normal browsing patterns. Endpoint detection can leverage MDM analytics to identify Chrome versions below 150.0.7871.47 on enrolled Android devices. Web security gateways may flag the destination sites if they are known malicious hosts, though novel sites used for exploitation may evade detection.

Why prioritize this

While Chromium rated this as Low severity and the CVSS score of 4.3 places it in the MEDIUM category, prioritize patching based on device risk profile: high for organizations with strict navigation policies or those managing Android devices in sensitive environments; lower for consumer deployments with no governance requirements. The lack of known active exploitation (not in KEV) and the requirement for user interaction reduce urgency compared to network-worm or zero-day threats. However, the widespread use of Chrome on Android and the simplicity of the fix argue for routine, timely patching rather than deferral.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM) reflects a network-accessible vulnerability requiring low attack complexity and user interaction, with integrity impact but no confidentiality or availability impact (vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). The score aligns with the Chromium Low severity rating—this is not a critical flaw, but it is substantive enough to warrant prompt patching as part of routine security maintenance. Organizations should not deprioritize this in favor of higher-CVSS issues, but neither should it monopolize security resources.

Frequently asked questions