CVE-2026-14129: Chrome Android UI Spoofing Vulnerability – Patch to 150.0.7871.47

Technical summary

CVE-2026-14129 is an inappropriate implementation vulnerability in Chrome's PreviewTab component on Android. The flaw permits UI spoofing attacks when a remote attacker crafts an HTML page that exploits the gesture-handling logic in the preview tab interface. The vulnerability requires user interaction—specifically deliberate UI gestures—to manifest. Google classified this as Low severity in Chromium's security taxonomy, though the CVSS 3.1 score of 4.2 reflects moderate practical concern due to the integrity and availability impacts possible through deceptive UI presentation.

Business impact

Organizations supporting Android users via Chrome face a social engineering risk. While the vulnerability does not enable data theft or code execution, successful exploitation could lead users to disclose information or perform actions based on false UI context—for example, believing they're on a legitimate login page when they're viewing attacker-controlled content. The requirement for specific user gestures limits the attack surface, but mobile users are often less cautious with gesture-based interactions than desktop users, increasing real-world risk in bring-your-own-device environments.

Affected systems

Google Chrome on Android versions prior to 150.0.7871.47 are vulnerable. The issue is specific to Android; desktop Chrome versions are not affected. Any Android device running an unpatched Chrome build before version 150.0.7871.47 presents exposure.

Exploitability

Exploitation requires two conditions: a crafted HTML page must be hosted or delivered to a user, and that user must perform specific UI gestures (the precise mechanics are not disclosed, which is typical for UI spoofing vulnerabilities to avoid trivializing weaponization). This is not a zero-click attack. An attacker cannot trigger it silently; user participation is necessary. The barrier to exploitation is moderate—convincing users to visit a malicious site and perform certain interactions is feasible through social engineering, but not trivial.

Remediation

Update Google Chrome on Android to version 150.0.7871.47 or later. No workarounds exist; patching is the only remediation. Users unable to update immediately should avoid visiting untrusted websites and be cautious when performing gesture-based interactions (swiping, long-pressing) in the preview tab interface, though this provides minimal practical protection.

Patch guidance

Google has released version 150.0.7871.47 to address this vulnerability. Android users should check Settings > About Chrome and allow automatic updates, or manually update via the Google Play Store. Enterprise administrators managing Chrome on Android via EMM/MDM solutions should push this minimum version to all Android devices. Verify deployment by checking Chrome version in chrome://version once devices have synchronized updates.

Detection guidance

Network monitoring cannot readily detect exploitation attempts since the attack occurs through legitimate HTTPS traffic to a crafted webpage. Endpoint detection should focus on anomalous Chrome version inventory; any devices running Android Chrome below 150.0.7871.47 should be flagged for mandatory update enforcement. Mobile device management consoles (Intune, VMware Workspace, etc.) provide version reporting. No log signatures or behavioral detection methods reliably identify exploitation after the fact due to the UI-level nature of the attack.

Why prioritize this

Although Chromium rated this Low severity and the CVSS score is modest at 4.2, the vulnerability warrants timely patching because: (1) Android Chrome has high user population, (2) UI spoofing attacks are effective social engineering vectors, especially on mobile devices where users may have lower context awareness, (3) the attack chain is plausible in real phishing campaigns, and (4) patching is simple and low-risk. This is a medium-priority issue—not critical, but appropriate for standard patch cycles within 4–6 weeks.

Risk score, explained

CVSS 3.1 score 4.2 (MEDIUM severity) reflects: Attack Vector Network (AV:N) because exploitation requires delivery of a crafted page; Attack Complexity High (AC:H) because specific UI gestures are mandatory and not user-default behaviors; Privileges Required None (PR:N); User Interaction Required (UI:R) due to the gesture prerequisite; no Scope change (S:U); no Confidentiality impact (C:N); Integrity impact Low (I:L) from UI spoofing; Availability impact Low (A:L) from potential user confusion or misdirection. The score accurately reflects a social-engineering-enabling vulnerability that is neither trivial nor severe.

Frequently asked questions