CVE-2026-14126: Chrome Android Domain Spoofing UI Flaw

Technical summary

CVE-2026-14126 involves an incorrect security UI implementation in Chrome for Android versions prior to 150.0.7871.47. The vulnerability stems from inadequate validation or presentation of domain information (CWE-451: User Interface (UI) Misrepresentation of Critical Information), permitting domain spoofing attacks. An unauthenticated remote attacker can craft a malicious HTML page that, when visited, causes the browser to misrepresent the actual domain being accessed. The attack surface is network-based with low complexity; exploitation hinges on user interaction. Google classified this as 'Low' severity within Chromium's internal rating system, though the CVSS 3.1 score of 4.3 reflects moderate impact in terms of integrity compromise.

Business impact

Domain spoofing attacks can lead to credential harvesting, social engineering, or malware distribution if users are deceived about which website they're visiting. For organizations with Android-based mobile workforces, this creates a subtle but real risk: employees may unknowingly enter credentials into attacker-controlled sites that visually mimic trusted services. The impact is primarily reputational and operational rather than immediate data loss, but it undermines user trust in the browser's security indicators—a critical component of the web's security model.

Affected systems

Google Chrome on Android versions earlier than 150.0.7871.47 are vulnerable. Desktop and other platforms are not mentioned in the advisory, suggesting this Android-specific UI rendering flaw does not affect Chrome on Windows, macOS, Linux, or other operating systems. Organizations should verify the exact Chrome version deployed on managed Android devices.

Exploitability

Exploitation is relatively straightforward: the attacker crafts a malicious HTML page and induces a user to visit it (via phishing link, advertisement, or other social engineering). No additional exploit tools, specialized network access, or user privilege escalation is required. However, effectiveness depends on the attacker's ability to convincingly spoof a legitimate domain in the UI, and user skepticism may limit real-world impact. The vulnerability has not been assigned KEV (Known Exploited Vulnerability) status, suggesting no active in-the-wild exploitation has been observed or publicly disclosed as of the advisory date.

Remediation

Update Google Chrome on Android to version 150.0.7871.47 or later. This patch corrects the security UI rendering logic to properly display and validate domain information. Organizations managing Android devices should deploy this update through their mobile device management (MDM) solution or advise users to update Chrome via the Google Play Store. No workarounds are available; patching is the only remediation.

Patch guidance

Chrome on Android auto-updates by default if the user has enabled automatic updates in the Play Store. For enterprise deployments, push the update via MDM policies to accelerate adoption. Verify that devices are running Chrome 150.0.7871.47 or later by checking Settings > About Chrome. If auto-update is disabled, users should manually check for updates in the Google Play Store. Monitor deployment status and prioritize devices used by high-risk roles (finance, human resources, executives) who may be targeted for credential theft.

Detection guidance

Detection of exploitation is challenging because the vulnerability manifests as a UI rendering issue rather than a crash or network anomaly. Endpoint Detection and Response (EDR) tools may flag suspicious web traffic to lookalike domains, but the browser itself will not generate obvious security alerts. Monitor for unusual sign-in attempts or compromised credentials from mobile sources, particularly if users report visiting unfamiliar-looking websites. Security awareness training should emphasize the importance of checking URL bars carefully and verifying HTTPS certificate information, even on mobile browsers.

Why prioritize this

While the Chromium severity rating is 'Low' and the vulnerability requires user interaction, the integrity impact (domain spoofing leading to credential compromise) justifies timely patching. Mobile browsers are increasingly vectors for phishing and credential theft, and any flaw in domain verification UI is a concern for organizations with significant mobile workforces. The relatively low CVSS score (4.3) means this should not disrupt other critical patching work, but it should be included in the next Chrome update cycle for Android devices.

Risk score, explained

The CVSS 3.1 score of 4.3 (Medium severity) reflects the attack vector (network-based, no authentication required), low attack complexity, required user interaction, and limited scope (no system-wide impact). The score emphasizes the integrity impact (I:L) rather than confidentiality or availability. The score appropriately captures that this is a real but not catastrophic flaw—it requires an attacker to conduct social engineering, yet the underlying browser security model remains intact. Organizations should treat this as a medium-priority patch rather than an emergency.

Frequently asked questions