CVE Catalog
CVE-2026-14020
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk0.19%
9th percentile — higher than 9% of all known CVEs
Summary
Insufficient validation of untrusted input in WebXR in Google Chrome prior to 150.0.7871.47 allows a remote attacker who has compromised the renderer process to perform UI spoofing via a crafted HTML page.
Risk Assessment
The risk involves UI spoofing attacks that could trick users into revealing sensitive information or performing unauthorized actions within the browser.
Recommendation
Update Google Chrome to version 150.0.7871.47 or later immediately to mitigate this vulnerability.
Original NVD description (English source)
Insufficient validation of untrusted input in WebXR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)