CVE-2026-14153: Google Chrome XSS Vulnerability

CVE-2026-14153 Overview

CVE-2026-14153 is a user interface (UI) spoofing vulnerability in the Glic component of Google Chrome. The flaw affects Chrome versions prior to 150.0.7871.47 across Windows, macOS, and Linux. A remote attacker who convinces a user to perform specific UI gestures can spoof interface elements through a crafted HTML page. The issue is classified under CWE-451: User Interface Misrepresentation of Critical Information. Chromium rates the internal security severity as Low, while NVD assigns a medium CVSS score of 5.3.

Critical Impact
Successful exploitation enables attackers to misrepresent browser UI elements, potentially tricking users into disclosing credentials or authorizing unintended actions.

Affected Products

Google Chrome versions prior to 150.0.7871.47
Chrome on Microsoft Windows, Apple macOS, and Linux desktop platforms
Any Chromium-derived browser embedding the vulnerable Glic component

Discovery Timeline

2026-06-30 - CVE-2026-14153 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-14153

Vulnerability Analysis

The vulnerability resides in Glic, a Chrome component responsible for rendering specific UI surfaces. An inappropriate implementation allows a crafted HTML page to influence how UI elements appear to the user. When the user performs particular gestures on the attacker-controlled page, the browser presents interface content in a way that misrepresents its origin or intent. This aligns with CWE-451, which covers scenarios where users cannot reliably distinguish trusted browser chrome from attacker-controlled content. The confidentiality impact reflects the potential for users to disclose sensitive information to what they believe is a legitimate interface element. The exploit prediction score (EPSS) of 0.181% places the vulnerability in the low-probability range for near-term exploitation.

Root Cause

The root cause is an inappropriate implementation in the Glic component that fails to enforce clear boundaries between page-controlled content and trusted browser UI. Because Glic renders interface elements that respond to user gestures, a crafted HTML page can position, style, or time content to overlap or imitate genuine browser controls. The absence of adequate UI integrity checks allows this misrepresentation to succeed.

Attack Vector

The attack requires network access and user interaction. An attacker hosts a crafted HTML page and lures a target to visit it. The victim must then perform specific UI gestures such as clicks, drags, or focus changes before the spoofed interface renders. High attack complexity reflects the required combination of user gestures and precise page conditions. No privileges are required on the target system, and the exploit runs entirely within the browser sandbox. Technical details are tracked in the Chromium Issue Tracker Entry.

Detection Methods for CVE-2026-14153

Indicators of Compromise

Chrome browser processes at versions earlier than 150.0.7871.47 connecting to untrusted external domains
User reports of unexpected browser dialogs, prompts, or overlays following link clicks
Web proxy logs showing visits to newly registered or low-reputation domains hosting HTML pages that trigger overlay content or scripted gesture handlers

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 150.0.7871.47
Correlate browser telemetry with phishing indicators such as credential submission events on domains without prior reputation
Monitor for HTML payloads containing suspicious pointer, focus, or drag event handlers combined with heavy positional CSS on overlay elements

Monitoring Recommendations

Enable centralized Chrome update reporting through Chrome Browser Cloud Management or equivalent tooling
Forward browser and endpoint telemetry to a SIEM for correlation with phishing and credential-theft detections
Track user-reported UI anomalies through help desk workflows and feed those signals into threat hunting queries

How to Mitigate CVE-2026-14153

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after the update to ensure the patched binaries are loaded
Verify the deployed version through chrome://settings/help or centralized management consoles

Patch Information

Google addressed CVE-2026-14153 in the Chrome Stable channel release documented in the Google Chrome Stable Update advisory. Administrators should confirm that automatic updates are enabled and that no group policy is pinning Chrome to a vulnerable build. Chromium-based browsers that consume upstream fixes should be updated once their vendors incorporate the patched Glic implementation.

Workarounds

Restrict browsing to trusted domains through enterprise web filtering while patching is in progress
Deliver user awareness reminders that highlight the risk of unexpected prompts triggered after unusual gestures on unfamiliar pages
Disable or restrict Chrome features that surface Glic UI where policy controls permit, until the patched version is deployed

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query installed Chrome version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# macOS: read Chrome version from the application bundle
defaults read "/Applications/Google Chrome.app/Contents/Info.plist" CFBundleShortVersionString