CVE-2026-14046 is a security vulnerability in Google Chrome on Android affecting versions before 150.0.7871.47. The flaw resides in the CustomTabs implementation, which improperly enforces the same origin policy. This allows a remote attacker to bypass this security control by crafting a malicious HTML page. The vulnerability is classified under CWE-346 (Origin Validation Error). The CVSS v3.1 base score is 4.3, indicating medium severity, with an attack vector of network, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. There is no explicit vendor advisory detail on patch availability or remediation level, but the affected versions list indicates that version 150.0.7871.47 is the fixed version.

The vulnerability allows a remote attacker to bypass the same origin policy in Google Chrome on Android, potentially enabling unauthorized interactions with web content that should be isolated by origin. The impact is limited to integrity, with no confidentiality or availability effects reported. This could lead to limited unauthorized actions within the browser context.

A fix is available in Google Chrome for Android version 150.0.7871.47. Users and administrators should update affected Chrome installations to version 150.0.7871.47 or later to remediate this vulnerability. There is no indication of any temporary workaround or alternative mitigation.