CVE-2026-14134: Android Chrome Autofill UI Spoofing Vulnerability (v150.0.7871.47 Patch)

Technical summary

CVE-2026-14134 is a UI spoofing vulnerability stemming from inappropriate implementation in Chrome's Autofill component on Android. The issue is classified under CWE-451 (User Interface (UI) Misrepresentation of Critical Information). An attacker can craft malicious HTML that spoofs Chrome's autofill interface, potentially tricking users into disclosing credentials or payment information. The vulnerability requires network access and user interaction but does not require elevated privileges. Google assigned this a Low severity rating within Chromium, though the CVSS 3.1 score of 4.3 reflects the limited scope of impact—integrity is compromised but confidentiality and availability are not affected.

Business impact

For organizations managing Android deployments or enforcing Chrome as a standard browser, this vulnerability introduces social engineering risk. Employees could be deceived by phishing pages that spoof autofill prompts, potentially leading to credential compromise or fraudulent payment processing. The risk is particularly elevated for workers accessing sensitive internal systems via Chrome on personal or corporate Android devices. However, the impact remains contained to individual user compromise; there is no risk of lateral movement or data exfiltration that would trigger widespread system failures.

Affected systems

The vulnerability affects Google Chrome on Android versions prior to 150.0.7871.47. Any organization or user running Chrome on Android should verify their installed version against this threshold. Desktop Chrome and Chrome on other platforms are not impacted by this specific flaw. The vulnerability does not affect Google Chrome OS, Windows, macOS, or Linux variants.

Exploitability

Exploitation is straightforward in technical complexity but depends entirely on user interaction. An attacker must craft an HTML page and convince a user to visit it—typically via phishing email, malicious advertisement, or compromised website. Once a user opens the page, the spoofed autofill UI may appear during normal browsing interaction, potentially triggering credential entry. No special network conditions, authentication bypass, or device-level exploitation is required. However, users who are security-aware or who disable autofill are less susceptible. This vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild is not currently documented, though the low barrier to weaponization means exploitation could emerge quickly.

Remediation

Update Google Chrome on Android to version 150.0.7871.47 or later. Users should check Settings > About Chrome to verify the installed version and enable automatic updates if not already configured. For organizations managing Android devices via Mobile Device Management (MDM) solutions, deploy a policy to enforce Chrome version 150.0.7871.47 minimum. In parallel, users should disable Autofill for sensitive fields if possible, use password managers with verification mechanisms, and remain cautious of unexpected autofill prompts during high-value transactions.

Patch guidance

Google has released Chrome version 150.0.7871.47 as the fixed version. Users with automatic updates enabled should receive the patch within days; manual update via the Play Store can be completed immediately. Verify successful patching by navigating to Settings > About Chrome; the version number should display 150.0.7871.47 or higher. Organizations using MDM for Android should validate the rollout within 5–7 days to ensure coverage. There are no known compatibility issues or breaking changes associated with this patch.

Detection guidance

Endpoint detection should monitor Chrome version inventory on Android devices via MDM reporting or manual asset discovery. For managed environments, configure alerts when Chrome versions fall below 150.0.7871.47. Web filtering and SIEM systems can flag suspicious autofill-related activity, such as unusual patterns of credential entry or multiple failed autofill attempts within short timeframes, though this detection method yields high false positives. User education remains the most practical detection vector: encourage reporting of suspicious autofill prompts or unexpected credential requests. Browser logs and Android system logs do not typically record autofill spoofing attempts in a way that allows easy forensic recovery.

Why prioritize this

While the CVSS score of 4.3 indicates low-to-medium severity, prioritization should account for user prevalence and social engineering risk. Android is a pervasive platform in the workplace, and autofill is an automatic feature that most users do not actively monitor. The attack requires minimal sophistication to execute, and even though KEV status is negative, the attack surface is broad. Organizations with high volumes of remote workers or BYOD policies should prioritize this patch within a 30-day window. Desktop Chrome users can deprioritize this issue.

Risk score, explained

The CVSS 3.1 score of 4.3 (Medium severity) reflects a network-accessible vulnerability with low attack complexity and no privilege requirement, but one requiring user interaction. The integrity impact is rated as Low because the vulnerability enables UI spoofing rather than system-level data theft; confidentiality and availability are unaffected. The 'Low' Chromium severity assignment indicates Google's engineering assessment that the practical risk is constrained by the user-interaction requirement and the limited scope of deception. The gap between Chromium severity and CVSS score stems from CVSS's metric structure, which treats any integrity compromise as impactful regardless of whether physical data is exfiltrated.

Frequently asked questions