CVE-2026-14072: Google Chrome XSS Vulnerability

CVE-2026-14072 Overview

CVE-2026-14072 is a user interface (UI) spoofing vulnerability in the SplitView component of Google Chrome versions prior to 150.0.7871.47. The flaw stems from an inappropriate implementation that allows a remote attacker to manipulate browser UI elements through a crafted HTML page. Successful exploitation requires user interaction, such as visiting a malicious website. The issue is classified under CWE-451: User Interface (UI) Misrepresentation of Critical Information. Google has rated the Chromium security severity as Low, and a fix has been shipped in the stable desktop channel.

Critical Impact
Attackers can spoof legitimate browser UI elements through crafted HTML, enabling convincing phishing scenarios that trick users into disclosing credentials or authorizing unintended actions.

Affected Products

Google Chrome for Desktop versions prior to 150.0.7871.47
Chromium-based browsers relying on the vulnerable SplitView implementation
All operating system builds distributed through the Chrome stable channel before the referenced release

Discovery Timeline

2026-06-30 - CVE-2026-14072 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-14072

Vulnerability Analysis

The vulnerability resides in Chrome's SplitView feature, which allows the browser to render multiple content panes within a single window. An improper implementation permits attacker-controlled HTML content to influence the rendering or positioning of browser UI elements. This behavior enables UI spoofing, where a malicious page can imitate trusted browser chrome or overlay deceptive content within the split panels.

The attack is network-reachable and requires user interaction to trigger. Confidentiality and availability are not directly affected, but integrity of the UI representation is compromised. Google classifies the issue under CWE-451, which covers misrepresentation of security-relevant information in the user interface.

Root Cause

The root cause is an inappropriate implementation within the SplitView code path. The component does not adequately isolate untrusted web content from surrounding browser UI regions. Crafted HTML can therefore render content in a manner indistinguishable from legitimate browser indicators.

Attack Vector

Exploitation requires the victim to load a malicious HTML page in a vulnerable Chrome build. Once loaded, the attacker's page manipulates SplitView rendering to imitate address bar indicators, security prompts, or dialog surfaces. This deception can support phishing campaigns targeting credentials, session tokens, or multi-factor authentication approvals.

No public proof-of-concept or exploit code has been published. Refer to the Chromium Issue Tracker Entry for technical detail as it becomes available.

Detection Methods for CVE-2026-14072

Indicators of Compromise

Chrome desktop clients reporting a version string below 150.0.7871.47 in enterprise inventory telemetry.
User reports of address bar or security indicator anomalies when browsing sites that use split-pane or side-by-side layouts.
Web proxy or DNS logs showing user navigation to newly registered domains hosting HTML designed to mimic Chrome UI chrome.

Detection Strategies

Query endpoint inventory data for installed Chrome versions and flag any host below the patched build.
Correlate phishing report tickets with browser version to identify users on vulnerable clients who visited suspicious pages.
Monitor HTTP response bodies at the proxy layer for pages that reference SplitView-specific CSS or DOM structures paired with fake credential prompts.

Monitoring Recommendations

Ingest Chrome update status and version telemetry into a centralized data lake for continuous compliance checks against 150.0.7871.47 or later.
Track outbound navigation to typosquatted or lookalike domains that could pair with UI spoofing content.
Enable browser policy reporting to capture crash and rendering anomalies that may indicate exploitation attempts.

How to Mitigate CVE-2026-14072

Immediate Actions Required

Update all Google Chrome desktop installations to version 150.0.7871.47 or later using the Stable channel.
Force a browser relaunch after update deployment to ensure the vulnerable SplitView code is unloaded from memory.
Verify the deployed version across managed endpoints and remediate stragglers through enterprise software distribution tools.

Patch Information

Google released the fix in the Stable Channel Update for Desktop. Administrators should reference the Google Chrome Update Blog for the associated release notes. The technical fix is tracked in the Chromium Issue Tracker Entry.

Workarounds

Enforce Chrome auto-update through enterprise policy (ChromeCleanupEnabled, DefaultBrowserSettingEnabled) so patched builds propagate quickly.
Deliver user awareness guidance instructing employees to verify the address bar in a single, maximized window rather than split layouts when entering credentials.
Restrict access to untrusted external sites through web filtering categories while the patch is being rolled out.

bash

# Configuration example
# Verify Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Expected output: version 150.0.7871.47 or higher