CVE-2026-14140: Android Chrome UI Spoofing Vulnerability (4.3 CVSS)

Technical summary

This vulnerability (CVE-2026-14140) is rooted in inadequate input validation (CWE-20) within Chrome's input handling mechanisms on Android. An attacker can exploit this by constructing a crafted HTML page containing specially formatted input that bypasses Chrome's security checks. The flaw permits UI redressing—a technique where attacker-controlled content overlays or mimics legitimate browser UI, potentially leading to phishing, credential theft, or unwanted action execution. The attack requires network access and user interaction (clicking, navigating) but does not depend on prior authentication or user privileges. Chromium has classified this as a Low severity issue at the component level, though the CVSS v3.1 rating reflects a Medium severity at the platform level due to the integrity impact and low attack complexity.

Business impact

UI spoofing attacks can erode user trust and increase phishing susceptibility. While this vulnerability does not permit direct data theft or system compromise, it enables social engineering at scale. Users may unknowingly authorize unwanted actions, visit credential-harvesting pages, or install malware. Organizations whose workforce relies on Android Chrome for email, banking, or SaaS access face elevated risk of credential compromise and account takeover. The low barrier to exploitation (a simple malicious link) means the vulnerability could be weaponized in mass phishing campaigns or supply-chain-adjacent attacks if widely deployed before patching.

Affected systems

Google Chrome on Android is affected in all versions prior to 150.0.7871.47. Desktop and iOS versions of Chrome are not mentioned in this advisory. The vulnerability is specific to the Android platform's input validation subsystem. Organizations should audit Chrome version distributions across Android devices—both company-managed and BYOD—to identify exposure. Third-party browsers using Chromium on Android may also be affected depending on their version and patching cadence.

Exploitability

Exploitability is straightforward from an attacker perspective. An attacker needs only to host a malicious HTML page and distribute a link (via email, SMS, ad networks, or social media). No special technical skills, zero-days, or privileged access are required. The attack succeeds if a user visits the page and interacts with spoofed UI elements. This low barrier to entry makes the vulnerability attractive for phishing and scareware campaigns. However, the attack is not remotely exploitable in the traditional sense—it requires user-driven navigation and interaction, limiting real-time control and reducing applicability to automated, unattended scenarios.

Remediation

Users should update Google Chrome on Android to version 150.0.7871.47 or later immediately. Organization administrators managing Android devices should deploy the update via their mobile device management (MDM) platform. For users on older Android versions that may not receive Chrome updates, mitigating controls include disabling JavaScript, using a more restrictive content security policy browser extension (if available), or switching to browsers with stricter input validation. However, patching remains the definitive remediation.

Patch guidance

Update Chrome on Android to 150.0.7871.47 or later. Users can enable automatic updates in Chrome's settings under 'About Chrome' to receive patches immediately upon release. Enterprise administrators should test the update in a pilot group, then roll out via MDM to ensure no regression in app compatibility or performance. No rollback should be necessary; newer versions maintain backward compatibility. Verify update status by checking Chrome's version information in settings; the patch should deploy within 24–48 hours for most users due to Google's staged rollout practices.

Detection guidance

Monitor for indicators of UI spoofing attacks: user reports of unexpected prompts, unusual authorization requests, or unrecognized form submissions. Use mobile device management or mobile threat defense (MTD) solutions to flag or block access to known malicious sites distributing exploits. Review network logs for suspicious traffic to phishing domains. Conduct user awareness training to recognize UI spoofing tactics (e.g., fake SSL warnings, out-of-place login forms). On the endpoint, monitor for unexpected app installs or permission escalations following browser visits. No specific CVE-level YARA or IDS rules are available at this stage; detection is primarily behavioral and user-reported.

Why prioritize this

Although the CVSS score (4.3) and Chromium severity (Low) suggest lower priority, the combination of ease of exploitation, lack of KEV listing, and widespread use of Android Chrome warrant prompt attention. UI spoofing is a proven attack vector in the wild. The vulnerability's reliance on user interaction reduces its criticality relative to remote code execution flaws, but the low exploitation barrier and phishing risk justify treating it as a near-term patching obligation rather than deferrable. Organizations should prioritize it above component-level vulnerabilities but below any active exploitation threats.

Risk score, explained

The CVSS v3.1 score of 4.3 (Medium) reflects an attack vector that is network-based, requires low complexity, demands user interaction, and results in limited integrity impact (UI spoofing). The lack of confidentiality or availability impact caps the score. Chromium's internal Low classification aligns with the technical assessment that the flaw is confined to input validation and does not enable code execution or data exfiltration. However, from a business risk perspective, the ease of weaponization for phishing and the prevalence of Android Chrome in enterprise mobility elevate practical risk beyond the numeric score.

Frequently asked questions