CVE-2026-14153

No known exploitation. EPSS puts it in the 17th percentile. Fixed in 150.0.7871.47.

CVSS 3.15.3Medium EPSS percentile17th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix150.0.7871.47Upgrade to this build

Published 2026-06-30Updated 2026-07-01Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Google ChromeAffected: ≥ 150.0.7871.47, < 150.0.7871.47Upgrade to: 150.0.7871.47Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check which Google Chrome version your business devices are running (Chrome menu → About Google Chrome).
If any devices are on Chrome versions earlier than 150.0.7871.46/150.0.7871.47, update Chrome to 150.0.7871.47 (or newer) using your normal update method.
After updating, re-check the Chrome version on a few devices to confirm they’re no longer on older builds.
Keep a basic reminder for staff: don’t follow unexpected “click here” UI prompts, especially when coming from unfamiliar pages.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Inappropriate implementation in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

In plain language

Written by AI from the record

This is a Google Chrome bug that lets a website trick a user into doing special clicks that can fake a real-looking screen; most small businesses won’t be directly affected, but it’s worth updating Chrome to the fixed version to reduce phishing risk.

In Google Chrome (Glic component), a UI spoofing weakness (CWE-451) can be triggered by a remote attacker convincing a user to perform specific UI gestures on a crafted HTML page, allowing a fake interface to appear legitimate; fixed in Chrome 150.0.7871.47 (and 150.0.7871.46).

If you're affected

Users tricked into fake dialogs
Credential or payment phishing risk
Trust and workflow disruption
Incidents from targeted scams

What is it

Imagine a website that can’t take control of your computer, but can “copy” parts of what looks like Chrome’s real screens. With the right trick, it can make you click in a way that shows a fake interface that looks trustworthy, which can be used to scam users. This bug is about how Chrome handles those specific UI gestures.

Who is affected

This matters if your business uses Google Chrome on desktops or workstations that browse the web. The attacker doesn’t need to be logged in and doesn’t need special access—what they do need is to convince a user to perform specific UI gestures while viewing a crafted page. It’s mainly a risk when a malicious page can reach your users and successfully gets them to interact with the prompts.

How urgent is it

This is a UI-spoofing issue that requires convincing a user to perform specific gestures, and there’s no public exploit code on record or KEV listing. Because it’s not confirmed as actively exploited, this is best handled as a standard patching item: update Chrome to the fixed version promptly in your next maintenance window. Prioritize devices used by people who browse the web often or receive frequent phishing attempts.

What to do — in detail

Confirm exposure on endpoints
- On each managed device, open Chrome → Menu → About Google Chrome.
- Note whether the version is earlier than 150.0.7871.46 (for the affected fixed line) or 150.0.7871.47.
Upgrade to the fixed version
- Upgrade Google Chrome to 150.0.7871.47.
- If you use a browser update policy that lands on 150.0.7871.46, confirm it matches your vendor’s supported fixed build; the provided fix references both 150.0.7871.46 and 150.0.7871.47.
Validate after updating
- Re-check About Google Chrome on a representative set of devices (at least one per user group or per OS image).
- Confirm the version is now at/above the fixed release.
Temporary workaround if you can’t patch immediately
- Reduce exposure by limiting user exposure to untrusted pages: restrict browsing to business-approved sites when possible and keep user training in place about suspicious “click” UI prompts.
- Encourage users to stop and report if they are asked to perform unusual clicks or gestures that don’t match what they expected to see.
What to monitor
- Look for user reports of unexpected “fake dialogs” or confusing browser UI that prompted them to enter information.
- If you have security tooling, monitor for phishing-style incidents tied to web browsing. (No specific indicators for this CVE were provided in the findings.)

Technical context

CVE-2026-14153 is a Google Chrome (Glic component) UI spoofing issue mapped to CWE-451 (inappropriate implementation). The mechanism, per findings, is that a remote attacker can trick a user into engaging in specific UI gestures on a crafted HTML page, causing a fake interface to appear legitimate.

Severity is described as Low by Chromium security severity (and CVSS is 5.3), with no KEV listing and no public exploit code on record. Exploitation requires user interaction (remote attacker must convince the user to perform specific gestures). Attack vector is network delivery via a crafted HTML page.

Fix: Google Chrome is fixed in 150.0.7871.47 (also referenced as fixed in 150.0.7871.46).

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS17th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 17th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

5 events over 15 days, from the signal feeds we watch.

2026-07-15OpenVAS check added
2026-07-01Patch availablerecord updated
2026-06-30Publishedweakness classified

Affected products

Googlecommercial · USaka google inc, google llc
- ChromeDesktop AppOn-premConsumer Software / browser

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Scored 5.3 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact

Weaknesses

CWE-451No name in the record

Sources

References in the record

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Chrome, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account