CVE-2026-14141: Google Chrome XSS Vulnerability

CVE-2026-14141 Overview

CVE-2026-14141 is a domain spoofing vulnerability in the Document Picture-in-Picture (PiP) feature of Google Chrome on Android. Versions prior to 150.0.7871.47 render security UI incorrectly, allowing a remote attacker to mislead users about the origin of content displayed inside the PiP window. Exploitation requires a user to load a crafted HTML page, after which the attacker can present spoofed origin information to facilitate phishing or social engineering. Chromium classifies the security severity as Low, and the issue is categorized under CWE-451: User Interface Misrepresentation of Critical Information.

Critical Impact
Attackers can spoof the displayed domain in Chrome's Document Picture-in-Picture window on Android, enabling convincing phishing campaigns that impersonate trusted sites.

Affected Products

Google Chrome on Android prior to version 150.0.7871.47
Document Picture-in-Picture feature in Chromium-based mobile builds
Downstream Android browsers that embed vulnerable Chromium releases

Discovery Timeline

2026-06-30 - CVE-2026-14141 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-14141

Vulnerability Analysis

The flaw resides in how Chrome on Android renders security indicators for the Document Picture-in-Picture window. Document PiP is a Chromium feature that allows a site to open an always-on-top window containing arbitrary HTML rather than a video element. Because the PiP window presents web content outside the main browser chrome, the origin indicator is the primary trust signal available to the user.

In versions before 150.0.7871.47, that indicator can be manipulated by a crafted page. An attacker controlling attacker.example can make the PiP window appear to originate from an unrelated, trusted domain. The victim sees content that looks like it belongs to a bank, mail provider, or enterprise portal while it is actually served by the attacker.

The issue is a user interface integrity failure rather than a memory safety bug. There is no impact to confidentiality or availability on the device itself, but the misrepresentation directly undermines phishing defenses that depend on users verifying origins.

Root Cause

The root cause is incorrect security UI logic when composing the Document PiP window on Android. The origin string presented to the user is not consistently bound to the actual document that populates the PiP surface, which maps to [CWE-451]. See the Chromium Issue Tracker Entry for the upstream discussion.

Attack Vector

Exploitation is network-based and requires user interaction. A victim must visit an attacker-controlled page and permit the site to open a Document Picture-in-Picture window. The attacker then structures the page so that the PiP window displays spoofed origin information alongside a login form or other high-value content. No authentication or elevated privileges are required on the target device.

The vulnerability is described in prose because no verified proof-of-concept code is published. Refer to the Google Chrome Release Update for the vendor's account of the fix.

Detection Methods for CVE-2026-14141

Indicators of Compromise

Android devices running Chrome versions earlier than 150.0.7871.47 observed in browser telemetry or MDM inventories.
Web traffic to newly registered domains that invoke the documentPictureInPicture.requestWindow() API shortly after page load.
Credential submissions from mobile Chrome sessions where the referring origin does not match the expected identity provider.

Detection Strategies

Correlate mobile browser user-agent strings against the patched Chrome version to identify exposed endpoints.
Inspect proxy or secure web gateway logs for HTML responses that call Document PiP APIs from low-reputation domains.
Hunt for phishing kits that reference documentPictureInPicture in client-side JavaScript delivered to Android clients.

Monitoring Recommendations

Track Chrome version compliance across managed Android fleets and flag devices lagging behind 150.0.7871.47.
Monitor identity provider logs for authentication attempts originating from mobile Chrome sessions preceded by unusual referrers.
Enable URL categorization and newly-observed-domain blocking on mobile egress paths to reduce exposure to spoofing pages.

How to Mitigate CVE-2026-14141

Immediate Actions Required

Update Google Chrome on Android to version 150.0.7871.47 or later through the Google Play Store.
Push the update to managed Android devices using enterprise mobility management (EMM) or mobile device management (MDM) policies.
Alert users to verify the address bar and origin indicators before entering credentials into any Picture-in-Picture window.

Patch Information

Google addressed the issue in the Chrome Stable channel release documented in the Google Chrome Release Update. The fix corrects how the Document Picture-in-Picture window renders origin information so that spoofed domain strings cannot be shown. Technical context is available in the Chromium Issue Tracker Entry.

Workarounds

Disable Document Picture-in-Picture through enterprise policy using the DocumentPictureInPictureEnabled setting on managed Chrome installations.
Instruct users to close any PiP window and interact with the main Chrome tab, where the address bar shows the authoritative origin.
Route mobile browsing through a secure web gateway that blocks unknown or low-reputation domains capable of hosting spoofed PiP content.

bash

# Configuration example: disable Document Picture-in-Picture via Chrome enterprise policy on Android
# Deploy this JSON via your EMM/MDM app configuration for com.android.chrome
{
  "DocumentPictureInPictureEnabled": false
}