CVE-2026-14154
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk3th percentile — higher than 3% of all known CVEs
Summary
An inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension.
Risk Assessment
The risk involves potential user deception through a spoofed interface, which could lead to disclosure of sensitive information or unauthorized actions within the browser.
Recommendation
It is recommended to immediately update Google Chrome to version 150.0.7871.47 or later and restrict extension installations to trusted sources only.
Original NVD description (English source)
Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)