CVE-2026-14129: Google Chrome XSS Vulnerability

CVE-2026-14129 Overview

CVE-2026-14129 is a user interface (UI) spoofing vulnerability in the PreviewTab component of Google Chrome on Android. The flaw affects Chrome versions prior to 150.0.7871.47 and stems from an inappropriate implementation that lets a remote attacker deceive users through crafted HTML content. Exploitation requires the victim to perform specific UI gestures on an attacker-controlled page, so the attack depends on social engineering. Chromium classifies the security severity as Low, and the vulnerability is tracked under [CWE-451] (User Interface Misrepresentation of Critical Information). No public proof-of-concept, exploitation activity, or CISA KEV listing has been reported.

Critical Impact
A remote attacker can spoof browser UI elements in Chrome on Android to trick users into trusting attacker-controlled content, enabling phishing and credential theft scenarios.

Affected Products

Google Chrome on Android prior to 150.0.7871.47
Google Android platform hosting vulnerable Chrome builds
Chromium-based mobile browsers sharing the PreviewTab implementation

Discovery Timeline

2026-06-30 - CVE-2026-14129 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-14129

Vulnerability Analysis

The vulnerability resides in Chrome for Android's PreviewTab feature, which renders link previews before navigation. An inappropriate implementation allows a crafted HTML page to manipulate the preview surface so that displayed content misrepresents the actual origin, URL, or trust indicators shown to the user. The issue is categorized as User Interface Misrepresentation of Critical Information under [CWE-451].

Successful exploitation depends on convincing the target to perform specific gestures such as long-press or preview-triggering interactions. Once triggered, the attacker-controlled markup can overlay or replace elements in the preview surface, producing a visual mismatch between what the user sees and what the browser would actually load or has loaded.

Because the confidentiality impact is none and the integrity and availability impacts are limited, the vulnerability does not yield direct code execution or data disclosure. Its practical risk lies in enabling downstream phishing, credential harvesting, or malicious link approval workflows on mobile devices.

Root Cause

The root cause is a design and rendering flaw in the PreviewTab component that fails to enforce a strict boundary between attacker-supplied HTML content and browser-controlled UI chrome. This lets untrusted content influence security-relevant indicators presented in the preview.

Attack Vector

The attack vector is network-based. An attacker hosts a crafted HTML page and lures the victim to visit it in Chrome on Android. Exploitation requires user interaction in the form of specific UI gestures. No authentication or elevated privileges are required on the target device.

No verified public exploit code is available. Technical background is documented in the Chromium Issue Tracker Entry.

Detection Methods for CVE-2026-14129

Indicators of Compromise

Chrome for Android clients on versions earlier than 150.0.7871.47 reporting user complaints about mismatched URLs or unexpected page origins after preview interactions.
Outbound HTTP requests from mobile devices to domains that closely mimic legitimate brands following link preview gestures.
Credential submissions or form posts originating from mobile Chrome sessions where the referrer chain shows preview-related navigation anomalies.

Detection Strategies

Inventory managed Android endpoints and flag Chrome installations with a version string below 150.0.7871.47 using mobile device management (MDM) telemetry.
Correlate mobile web proxy logs against known phishing domains and lookalike hosts that could weaponize UI spoofing on Android Chrome.
Hunt for user-reported phishing incidents that reference link previews, long-press gestures, or discrepancies between displayed and visited URLs.

Monitoring Recommendations

Ingest mobile browser version telemetry into a centralized SIEM or data lake for continuous version-drift monitoring.
Monitor authentication providers for credential submissions from mobile devices immediately followed by risk signals such as impossible travel or new device enrollment.
Track Google Chrome release advisories, including the Google Chrome Stable Update, to detect follow-on issues in the same component.

How to Mitigate CVE-2026-14129

Immediate Actions Required

Update Google Chrome on all Android devices to version 150.0.7871.47 or later through the Google Play Store or enterprise MDM.
Enforce a minimum Chrome version policy on managed Android fleets and quarantine devices that fail to update within the defined window.
Deliver targeted user awareness communications explaining that link previews on mobile browsers can be manipulated and should not be treated as authoritative.

Patch Information

Google addressed CVE-2026-14129 in the Chrome Stable channel starting with version 150.0.7871.47. Refer to the Google Chrome Stable Update advisory and the associated Chromium Issue Tracker Entry for release details.

Workarounds

Instruct users to open links directly rather than relying on PreviewTab gestures until patched builds are deployed.
Deploy mobile phishing protection and DNS filtering to block known malicious domains that could leverage UI spoofing.
Restrict installation of untrusted browser variants and enforce Play Store managed configurations on corporate Android devices.

bash

# Verify installed Chrome version on a managed Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output for a patched device:
# versionName=150.0.7871.47