CVE-2026-14126 is a vulnerability in Google Chrome on Android where an incorrect security UI can be manipulated by a remote attacker through a crafted HTML page to perform domain spoofing. This could mislead users about the authenticity of a website. The issue affects versions prior to 150.0.7871.47. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and no availability impact. The vulnerability is categorized under CWE-451 (Incorrect Security UI).

The vulnerability allows remote attackers to spoof domains via crafted HTML, potentially misleading users about the legitimacy of websites they visit. This could facilitate phishing or social engineering attacks. However, the impact is limited to integrity and does not affect confidentiality or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The provided vendor advisory link does not explicitly state that a fix is available or deployed. Users should monitor official Google Chrome release notes and update to version 150.0.7871.47 or later once confirmed patched. Until then, caution is advised when interacting with untrusted web content on affected versions.