An incorrect security UI implementation in the Select component of Google Chrome on Mac versions before 150.0.7871.47 allowed remote attackers to spoof the Omnibox contents by crafting a malicious HTML page. This vulnerability is tracked as CVE-2026-14077 and is associated with CWE-451 (Incorrect Expression of Security Controls). The CVSS v3.1 base score is 4.3, indicating a medium severity issue with low impact on confidentiality and availability but some integrity impact. The vendor advisory linked does not explicitly state if a fix is available or if users must take action.

The vulnerability allows remote attackers to spoof the URL bar contents, potentially misleading users about the actual website they are visiting. This can facilitate phishing or social engineering attacks by making malicious sites appear legitimate. However, the impact on confidentiality and availability is none, and the integrity impact is low. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Users should update to version 150.0.7871.47 or later once confirmed. Until then, exercise caution with untrusted web content.