CVE-2026-14141: Chrome Android Picture-in-Picture Domain Spoofing Vulnerability

Technical summary

CVE-2026-14141 is a user interface spoofing vulnerability in Chrome's Document Picture-in-Picture implementation on Android. The flaw stems from incorrect security UI rendering (CWE-451), allowing an attacker to obscure or misrepresent domain information through a crafted HTML page. The vulnerability requires user interaction—a victim must view the malicious page—but has no authentication prerequisites and operates over the network. The attack vector is low complexity, and the impact is limited to integrity (domain spoofing), with no confidentiality or availability impact. Chromium's internal severity assessment rated this as 'Low,' though the CVSS 3.1 score of 4.3 reflects 'Medium' severity due to the nature of the spoofing risk.

Business impact

This vulnerability primarily threatens users of Android Chrome who rely on visual domain verification to confirm website legitimacy. In enterprise environments, mobile users could be tricked into entering credentials on fake login pages or downloading malicious content, creating a vector for credential theft, social engineering, and phishing campaigns. Organizations with significant Android mobile usage—particularly those handling sensitive transactions or communications—face elevated risk of user compromise. The impact is contained to individual user sessions rather than affecting backend systems or enabling mass exploitation.

Affected systems

Google Chrome on Android devices running versions prior to 150.0.7871.47 are affected. This includes all Android operating system versions that support the affected Chrome releases. Desktop Chrome and Chrome on other platforms are not impacted. The vulnerability is specific to the Picture-in-Picture document feature, so it only manifests when that feature is actively used or available in a user's session.

Exploitability

Exploitability is relatively straightforward from an attacker perspective. A crafted HTML page is the only requirement, and the attack is deliverable via standard web mechanisms—no special tools or advanced capabilities needed. However, practical exploitation requires user interaction: a victim must navigate to or load the malicious page and interact with the Picture-in-Picture feature. The attack does not require the victim to be logged in or have special permissions. The low technical bar for weaponization is balanced by the need for social engineering to drive users to the malicious content. No known public exploits or active exploitation have been reported.

Remediation

Users should update Chrome on Android to version 150.0.7871.47 or later as soon as possible. Google has released patches through its standard Chrome update mechanism. Organizations managing Android devices should enforce automatic updates or schedule expedited patching for Chrome. For users unable to immediately patch, avoiding use of Picture-in-Picture mode provides temporary mitigation, though this is not a practical long-term solution. Verify the domain display in the address bar before entering sensitive credentials or making transactions.

Patch guidance

Check your Chrome version by opening Chrome, tapping the three-dot menu, selecting 'About Chrome,' and confirming the version number. If you are running a version prior to 150.0.7871.47, update immediately. Chrome typically auto-updates in the background on Android, but you can manually trigger an update through the Google Play Store if needed. Enterprise organizations deploying Chrome through mobile device management (MDM) should push the patched version to all managed devices and monitor compliance. Verify the patch deployment by confirming the updated version across your fleet.

Detection guidance

From a detection and response standpoint, security teams can monitor for users reporting suspicious login pages or domain-spoofing warnings. Endpoint detection tools on Android devices should track Chrome version compliance and flag out-of-date installations. Review enterprise credential logs for unusual login attempts from unexpected geographies or devices, which may correlate with phishing attempts leveraging this vulnerability. Monitor for user reports of unexpected Picture-in-Picture window behavior or domain display anomalies. Since the vulnerability requires user interaction and is UI-based, behavioral indicators (failed login attempts, user complaints) may be more reliable than technical log signatures.

Why prioritize this

While Chromium internally assessed this as 'Low' severity, the CVSS score of 4.3 (Medium) and the integrity impact through domain spoofing warrant moderate prioritization. The accessibility of Android Chrome, the prevalence of mobile banking and credential entry on mobile devices, and the ease of crafting exploit HTML make this a practical risk despite low attack complexity and low impact per incident. Organizations should prioritize patching based on mobile user base size and the sensitivity of transactions those users perform. This is not a critical vulnerability but should not be deferred indefinitely.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a network-based attack with low attack complexity, no privilege escalation, and user interaction required. The severity is 'Medium' due to the integrity impact (domain spoofing) combined with the practical risk of credential theft. The score appropriately captures that while this is not a remote code execution or system-level vulnerability, the user-facing nature and spoofing potential create real business risk. The lack of confidentiality or availability impact prevents a higher score, but the spoofing aspect justifies the 'Medium' rather than 'Low' classification.

Frequently asked questions