This vulnerability, identified as CVE-2026-14114, affects Google Chrome on Android versions before 150.0.7871.47. It stems from an inappropriate implementation in the WebAppInstalls feature, enabling a local attacker to conduct UI spoofing attacks by leveraging a malicious file. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges or user interaction, impacting integrity but not confidentiality or availability. The issue is categorized under CWE-451 (Incorrect Expression). Although a vendor advisory link is provided, it does not explicitly state patch availability or remediation details.

An attacker with local access can exploit this vulnerability to spoof the user interface, potentially misleading users into performing unintended actions. The integrity of the application is compromised, but confidentiality and availability are not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution with local files and avoid untrusted sources. Monitor for updates from Google regarding a security update addressing this issue.