CVE-2026-14089: Chrome PopupBlocker Input Validation Flaw Enables UI Spoofing

Technical summary

CVE-2026-14089 is an input validation weakness (CWE-20) in the PopupBlocker component of Google Chrome versions prior to 150.0.7871.47. The vulnerability allows UI spoofing attacks when a remote attacker controls the renderer process—a prerequisite that indicates this is a post-compromise attack vector rather than a primary infection mechanism. An attacker would craft a specially formatted HTML page designed to bypass PopupBlocker's input sanitization, resulting in misleading visual elements being displayed to the user. The CVSS 3.1 score of 4.3 (MEDIUM) reflects a network-based attack requiring no privileges, user interaction, and resulting in integrity impact only.

Business impact

The practical business risk is moderate. Successful exploitation requires the attacker to have already compromised the Chrome renderer process, limiting the attack to environments where initial access has been established. The integrity impact—UI spoofing—can be weaponized for phishing, credential harvesting, or social engineering to trick users into revealing sensitive information or taking harmful actions. Organizations relying on Chrome for sensitive workflows should view this as part of a defense-in-depth strategy: preventing renderer compromise is the first line of defense, and prompt patching limits secondary attack surface.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are affected. This includes stable releases, extended stable variants, and older versions. Chromium-based browsers that incorporate PopupBlocker without the security patch may also be affected; organizations should consult browser vendors for their own patch status. The vulnerability does not affect Chrome OS, Chrome extensions, or Chrome Web Store separately—only the core Chrome browser application.

Exploitability

Exploitability is constrained by a critical prerequisite: the attacker must have already compromised Chrome's renderer process. This means the vulnerability is not a primary attack vector but rather a secondary exploitation technique available to sophisticated threat actors who have achieved code execution within the browser. The malicious HTML page itself is trivially easy to craft once renderer access exists, but obtaining that access is the barrier. The requirement for user interaction (visiting the crafted page) adds minimal friction if the attacker controls the compromised renderer. This vulnerability was not flagged for CISA KEV catalog inclusion, indicating no active wild exploitation has been reported.

Remediation

Update Google Chrome to version 150.0.7871.47 or later immediately. Users should enable automatic updates to receive patches as soon as they are deployed. Organizations managing Chrome deployments should use update policies to enforce the patched version across their fleet. Given the low active threat level (no KEV designation), this can be scheduled as part of routine patch cycles rather than emergency out-of-band updates, though doing so within 30 days is prudent.

Patch guidance

Verify that your Chrome installation is running version 150.0.7871.47 or higher by navigating to Chrome menu > Help > About Google Chrome; the browser will automatically check for updates and display the current version. For enterprise deployments, use the official Google Chrome Enterprise release notes and update management tools (Google Update, WSUS integration, or native MDM controls) to enforce the patched version. No workarounds exist; patching is the only mitigation. Test the patch in a non-production environment first if your organization has custom Chrome configurations or critical extensions.

Detection guidance

Detection of exploitation attempts is challenging because the attack occurs post-compromise within the renderer process and relies on user interaction with a crafted page. Monitor for unusual Chrome renderer process behavior, such as abnormal memory usage, unexpected child processes, or suspicious network connections. Log and review user reports of unexpected popup blockers or UI elements that appear out of context. Behavioral analysis tools that track renderer-process-level events may detect crafted HTML being loaded in compromised contexts. Focus detection efforts on identifying the initial renderer compromise (malware infection, drive-by download, etc.) rather than the PopupBlocker spoofing itself.

Why prioritize this

While the CVSS score is medium (4.3), the actual business priority should be lower due to the renderer-compromise prerequisite and lack of active wild exploitation. Prioritize patching after addressing any zero-day or high-severity items, but do not deprioritize indefinitely. The integrity-only impact (no data theft or availability loss) and user-interaction requirement further reduce urgency. However, if your threat model includes sophisticated threat actors capable of renderer exploitation, or if you operate in high-value industries, advance this to the 30-day patch window.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM) reflects: network-based attack vector (AV:N), low attack complexity requiring no special conditions (AC:L), no privileges required (PR:N), and user interaction required (UI:R). The impact is limited to integrity (I:L)—the attacker can spoof UI but cannot steal data or crash the browser. The unchanged scope (S:U) means the attack does not jump security boundaries. The score appropriately de-weights this issue because the renderer-compromise prerequisite is not captured in CVSS, making the practical exploitability considerably lower than the numeric score suggests.

Frequently asked questions