This vulnerability (CVE-2026-14141) concerns an incorrect security user interface in the Document Picture-in-Picture feature of Google Chrome on Android. The flaw allows a remote attacker to spoof domains by crafting a malicious HTML page, potentially misleading users about the origin of content. The issue affects Chrome versions prior to 150.0.7871.47. The CVSS 3.1 base score is 4.3, reflecting low impact on confidentiality, low impact on integrity, and no impact on availability. The vendor advisory link is provided but does not explicitly confirm patch availability or remediation level.

The vulnerability enables domain spoofing through UI manipulation, which could mislead users about the authenticity of web content. There is no direct impact on confidentiality or availability. The integrity impact is low, as the attacker can cause UI deception but not directly alter data or system state. No known exploits are reported, reducing immediate risk.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Users should update to Chrome version 150.0.7871.47 or later once confirmed. Until then, exercise caution with untrusted web content in Picture-in-Picture mode on Android Chrome.