CVE-2026-14034

MediumCVSS 4.3

Published: 30/06/2026(UTC)Updated: 01/07/2026(UTC)Translated: 02/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile — higher than 8% of all known CVEs

Summary

Inappropriate implementation in WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. The vulnerability has a low severity rating according to Chromium.

Risk Assessment

An attacker could exploit this vulnerability to bypass navigation restrictions, potentially leading to unauthorized access to pages or features that would normally be blocked. The risk is low but could be used in combination with other vulnerabilities.

Recommendation

It is recommended to immediately update Google Chrome on Android to version 150.0.7871.47 or later, which includes a fix for this vulnerability.

Original NVD description (English source)

Inappropriate implementation in WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)