CVE-2026-14130: Google Chrome XSS Vulnerability

CVE-2026-14130 Overview

CVE-2026-14130 is a user interface spoofing vulnerability in the Omnibox component of Google Chrome versions prior to 150.0.7871.47. A remote attacker can exploit this flaw by serving a crafted HTML page that manipulates the address bar display. The issue maps to CWE-451 (User Interface Misrepresentation) and CWE-20 (Improper Input Validation). Google classifies the underlying Chromium severity as Low, while the NVD assigns a moderate CVSS score reflecting integrity impact on the browser UI. Successful exploitation requires user interaction with the malicious page.

Critical Impact
Attackers can spoof security indicators in the Chrome Omnibox to trick users into trusting attacker-controlled content, enabling phishing and credential theft campaigns.

Affected Products

Google Chrome desktop versions prior to 150.0.7871.47
Chromium-based downstream browsers that inherit the affected Omnibox code
Stable channel desktop builds released before the June 2026 update

Discovery Timeline

2026-06-30 - CVE-2026-14130 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-14130

Vulnerability Analysis

The vulnerability resides in Chrome's Omnibox, the combined address and search bar that also renders security indicators such as the URL origin and connection state. Incorrect handling of specially crafted HTML content causes the Omnibox to display information that does not accurately reflect the true origin of the loaded page. This misrepresentation undermines the trust boundary users rely on when evaluating a site's legitimacy.

Because the flaw only affects the confidentiality-adjacent visual representation rather than executing code, the browser sandbox and site isolation remain intact. However, integrity of the security UI is degraded, which is the primary risk vector.

Root Cause

The root cause is improper input validation in the code path that constructs the displayed URL or security state in the Omnibox. When a crafted HTML page triggers specific rendering conditions, the Omnibox fails to reconcile the displayed value with the underlying origin, resulting in a spoofed indicator.

Attack Vector

Exploitation is network-based and requires the victim to visit an attacker-controlled or compromised web page. No authentication is required, but user interaction is necessary. The attacker delivers a crafted HTML payload that manipulates the Omnibox to display a misleading URL or security state, which can then be paired with a phishing lure to harvest credentials or session tokens. Additional technical detail is tracked in the Chromium Issue Tracker Entry.

Detection Methods for CVE-2026-14130

Indicators of Compromise

Chrome browser processes loading pages that repeatedly manipulate history.pushState, window.open, or long redirect chains targeting the address bar
Outbound HTTP requests to newly registered or typosquatted domains following user visits to unfamiliar sites
Credential submissions to hosts whose true origin differs from the domain displayed to the user

Detection Strategies

Inventory Chrome installations across the fleet and flag versions below 150.0.7871.47 for accelerated patching
Correlate DNS and proxy telemetry with browser navigation history to identify visits to known phishing infrastructure
Monitor endpoint browser telemetry for anomalous URL-manipulation patterns that precede credential entry

Monitoring Recommendations

Ingest browser version and update status into the SIEM to maintain continuous visibility into vulnerable endpoints
Alert on user reports of address bar anomalies and correlate with recent web traffic
Track phishing-related IOCs in threat intelligence feeds and block confirmed malicious hosts at the web proxy

How to Mitigate CVE-2026-14130

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all managed endpoints
Force browser restarts through enterprise management tooling to ensure the patched binary is active
Verify Chromium-based derivative browsers have absorbed the upstream fix before considering them remediated

Patch Information

Google addressed CVE-2026-14130 in the Chrome Stable channel update for desktop. Full remediation details are available in the Google Chrome Update Announcement. Administrators should deploy the update through Chrome Browser Cloud Management, Group Policy, or the platform's native software distribution mechanism.

Workarounds

Enable enterprise phishing and malware protection policies such as SafeBrowsingProtectionLevel set to enhanced
Enforce URL allowlists for high-value web applications to reduce exposure to arbitrary malicious pages
Train users to verify site legitimacy through certificate details rather than relying solely on the Omnibox display

bash

# Configuration example: enforce Chrome auto-update and enhanced Safe Browsing via policy (Linux managed policy JSON)
cat >/etc/opt/chrome/policies/managed/cve-2026-14130.json <<'EOF'
{
  "SafeBrowsingProtectionLevel": 2,
  "ComponentUpdatesEnabled": true,
  "DefaultBrowserSettingEnabled": true,
  "TargetVersionPrefix": "150.0.7871.47"
}
EOF