CVE-2026-14077: Google Chrome XSS Vulnerability

CVE-2026-14077 Overview

CVE-2026-14077 is a URL bar spoofing vulnerability in Google Chrome on macOS. The flaw exists in the Select HTML element implementation in Chrome versions prior to 150.0.7871.47. A remote attacker can craft a malicious HTML page that manipulates the contents of the Omnibox (URL bar), presenting a misleading address to users. The issue is classified under [CWE-451: User Interface (UI) Misrepresentation of Critical Information], commonly known as UI spoofing. Google's Chromium security team rated the severity as Low, and NVD assigned a medium CVSS score of 4.3. Successful exploitation requires user interaction with the crafted page.

Critical Impact
Attackers can spoof the Omnibox to make malicious pages appear to originate from trusted domains, enabling credible phishing attacks against macOS Chrome users.

Affected Products

Google Chrome for macOS prior to version 150.0.7871.47
Apple macOS (all supported versions running vulnerable Chrome builds)
Chromium-based components using the affected Select implementation on macOS

Discovery Timeline

2026-06-30 - CVE-2026-14077 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-14077

Vulnerability Analysis

The vulnerability resides in Chrome's implementation of the HTML <select> element on macOS. The Select control interacts with the browser's native UI layer to render dropdown options. Under specific rendering conditions, this interaction allows attacker-controlled content to influence what is displayed in the Omnibox.

The Omnibox is the primary trust indicator users rely on to verify a page's origin. When a crafted page manipulates its contents, users cannot distinguish between the actual URL and the spoofed value. This undermines the same-origin trust model that browsers depend on for phishing defense.

The issue is limited to macOS builds, indicating a platform-specific rendering path in the Select widget. The confidentiality impact is None, integrity impact is Low, and availability impact is None, reflecting the spoofing nature of the flaw rather than direct code execution.

Root Cause

The root cause is improper handling of UI state transitions between the Select element and the browser chrome on macOS. Chrome's native menu rendering on macOS does not sufficiently isolate page-controlled content from address bar rendering during Select interactions, permitting the URL display to reflect attacker-supplied data.

Attack Vector

Exploitation requires a victim to visit an attacker-controlled webpage and interact with a crafted Select element. Once triggered, the Omnibox displays a spoofed URL while the page content remains attacker-controlled. This deception supports credential harvesting, malware distribution, and other phishing scenarios that depend on domain impersonation.

The vulnerability manifests through DOM manipulation combined with Select element rendering timing. Refer to the Chromium Issue Tracker Entry and the Google Chrome Update Announcement for additional technical context.

Detection Methods for CVE-2026-14077

Indicators of Compromise

Chrome browser versions on macOS below 150.0.7871.47 present in endpoint inventory
Web traffic to unfamiliar domains that visually mimic legitimate sites in user reports
Phishing reports where users describe a trusted URL in the address bar but unexpected page content
HTML pages containing unusual <select> element manipulation combined with navigation events

Detection Strategies

Query endpoint inventory for Chrome installations on macOS with versions prior to 150.0.7871.47
Monitor DNS and proxy logs for connections to newly registered domains hosting HTML pages served to macOS Chrome user agents
Correlate user-reported phishing incidents with browser user agent strings identifying vulnerable Chrome builds
Inspect suspicious pages in a sandbox to identify Select element abuse patterns tied to Omnibox manipulation

Monitoring Recommendations

Track Chrome version distribution across the macOS fleet using MDM or endpoint telemetry
Alert on user-reported cases where address bar and page content appear inconsistent
Ingest browser telemetry into a centralized data lake to correlate visited URLs with reported phishing incidents
Review web gateway logs for high volumes of macOS Chrome traffic to low-reputation domains

How to Mitigate CVE-2026-14077

Immediate Actions Required

Update Google Chrome on all macOS endpoints to version 150.0.7871.47 or later
Enforce automatic Chrome updates through enterprise policy on macOS devices
Notify users of active phishing risks and reinforce verification of page content beyond the URL bar
Audit macOS fleet to confirm no Chrome installations remain below the patched version

Patch Information

Google released the fix in Chrome Stable channel version 150.0.7871.47 for macOS. Details are published in the Google Chrome Update Announcement. Administrators should deploy this update through their standard software distribution mechanism and verify installation on all managed macOS endpoints.

Workarounds

Restrict browsing to trusted domains through web filtering until the patch is applied
Deploy managed Chrome policies that enforce update installation on next browser restart
Train users to verify page authenticity through certificate details rather than the Omnibox alone
Consider temporary use of an alternate browser on macOS for high-risk workflows until patching completes

bash

# Verify Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Enforce automatic updates via defaults (run per user)
defaults write com.google.Keystone.Agent checkInterval 3600