CVE-2026-14140: Google Chrome Android XSS Vulnerability

CVE-2026-14140 Overview

CVE-2026-14140 is an input validation vulnerability in the Input component of Google Chrome on Android versions prior to 150.0.7871.47. The flaw allows a remote attacker to perform user interface (UI) spoofing through a crafted HTML page. Chromium's security team rated the underlying issue as Low severity, while the National Vulnerability Database assigns a medium score reflecting network reachability and user interaction requirements. The vulnerability is categorized under [CWE-20] Improper Input Validation.

Critical Impact
An attacker can craft a malicious web page that spoofs browser UI elements on Android, enabling phishing and social engineering attacks against Chrome users who interact with the crafted content.

Affected Products

Google Chrome on Android prior to 150.0.7871.47
Chromium-based mobile browsers sharing the affected Input component
Android devices running vulnerable Chrome builds

Discovery Timeline

2026-06-30 - CVE-2026-14140 published to the National Vulnerability Database
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-14140

Vulnerability Analysis

The vulnerability resides in the Input handling component of Google Chrome on Android. Insufficient validation of untrusted input allows attacker-controlled content to influence how the browser renders interactive UI elements. Because mobile browser chrome and web content share limited screen real estate, spoofed elements can convincingly imitate legitimate browser prompts, address bars, or permission dialogs.

Exploitation requires user interaction, meaning the victim must visit or interact with a crafted HTML page. The attack does not compromise confidentiality or availability but degrades integrity by misleading users about the origin or authenticity of displayed content. This class of flaw commonly enables phishing, credential capture, and consent-hijacking scenarios.

Root Cause

The root cause is improper validation of untrusted input processed by the Input subsystem in Chrome for Android. When the browser accepts and renders attacker-controlled input without adequate sanitization or contextual checks, it becomes possible to influence how UI surfaces are presented to the user. The issue is tracked in the Chromium Issue Tracker Entry.

Attack Vector

The attack is delivered over the network through a crafted HTML page. An attacker hosts or injects malicious HTML that leverages the input handling weakness to display spoofed UI content. When a victim visits the page and performs an expected interaction, such as tapping or scrolling, the spoofed interface can be used to trick the user into providing credentials, approving prompts, or executing further attacker-desired actions. No elevated privileges are required, and the attack scope is limited to the affected browsing context.

Since no verified proof-of-concept code is publicly available, refer to the Google Chrome Stable Update for vendor guidance.

Detection Methods for CVE-2026-14140

Indicators of Compromise

Chrome on Android builds reporting a version earlier than 150.0.7871.47 in enterprise inventory data
Reports from users describing browser prompts, address bars, or dialogs behaving inconsistently on specific sites
Access logs showing user traffic to newly registered or low-reputation domains serving crafted HTML content

Detection Strategies

Inventory managed Android devices and identify Chrome installations below the patched version 150.0.7871.47
Correlate mobile browsing telemetry with threat intelligence feeds to identify sessions with known phishing or spoofing infrastructure
Monitor for unusual credential submission patterns from mobile Chrome user agents against enterprise identity providers

Monitoring Recommendations

Track Chrome for Android version distribution across managed fleets through mobile device management (MDM) reporting
Enable web filtering and DNS-layer inspection to block domains flagged for phishing or UI spoofing campaigns
Review identity provider authentication logs for anomalies consistent with credential harvesting following mobile browser sessions

How to Mitigate CVE-2026-14140

Immediate Actions Required

Update Google Chrome on Android to version 150.0.7871.47 or later through the Google Play Store
Push mandatory browser updates to managed Android devices via MDM policies
Communicate the risk of UI spoofing to end users and reinforce verification of authentication prompts on mobile devices

Patch Information

Google released the fix in Chrome for Android version 150.0.7871.47. Details are available in the Google Chrome Stable Update announcement, and the underlying issue is referenced in the Chromium Issue Tracker Entry. Organizations should prioritize deployment across all managed Android endpoints running Chrome.

Workarounds

Restrict browsing to trusted sites through enterprise web filtering until patching completes
Enforce phishing-resistant authentication such as FIDO2 or hardware security keys to reduce impact of successful spoofing
Advise users to close and reopen the browser if UI elements appear inconsistent, and to avoid entering credentials into unexpected prompts

bash

# Example MDM policy to enforce minimum Chrome version on Android
# Managed Google Play configuration key
{
  "minimumVersionCode": 787104700,
  "packageName": "com.android.chrome",
  "installType": "FORCE_INSTALLED",
  "autoUpdateMode": "AUTO_UPDATE_HIGH_PRIORITY"
}