This vulnerability (CVE-2026-14142) affects Google Chrome versions before 150.0.7871.47 and involves an inappropriate implementation in the Extensions component. It enables a remote attacker, with control over the renderer process, to conduct UI spoofing attacks using crafted HTML content. The issue is classified under CWE-451 (Incorrect Expression of User Interface in Web Page). The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact. The vendor advisory linked does not explicitly state if a patch is available or if the issue is mitigated, so patch status is not confirmed.

The vulnerability allows UI spoofing, which can mislead users by presenting deceptive user interface elements. This could potentially facilitate social engineering attacks but does not directly impact confidentiality or availability. The attack requires that the attacker has already compromised the renderer process and that the user interacts with the crafted HTML page.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Until official confirmation, users should update to version 150.0.7871.47 or later once available and exercise caution with untrusted content that could exploit the renderer process.