CVE-2026-14013 is a medium severity vulnerability in Google Chrome's SVG implementation before version 150.0.7871.47. It enables remote attackers to conduct UI spoofing attacks by crafting malicious HTML pages. The vulnerability is identified as CWE-451 (Incorrect Implementation). The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. The vendor advisory link is provided but does not specify if an official fix has been released.

The vulnerability allows remote attackers to perform UI spoofing, potentially misleading users by displaying deceptive user interface elements. There is no direct impact on confidentiality or availability. The integrity impact is limited, reflecting the ability to spoof UI but not to alter data or system state significantly. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Users and administrators should monitor official Google Chrome release notes for updates addressing this vulnerability. Until a fix is confirmed, exercising caution with untrusted HTML content is advisable.