Google Chrome TabStrip inappropriate implementation enables UI spoofing

CVE-2026-14139 is an *inappropriate implementation* in Chrome's TabStrip component — the horizontal bar at the top of the browser that renders tabs. Per Google's advisory, versions of Chrome prior to 150.0.7871.47 allow a remote attacker who convinces a user to perform a specific interaction (typically a drag, drop, or gesture across tabs) to trigger some form of spoofing or minor state confusion. CWE-451 pins this squarely as a UI misrepresentation class bug — think address-bar or tab-title spoofing, not memory corruption and not sandbox escape.

Google's MEDIUM (4.2) rating is honest and probably slightly generous. The CVSS vector AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L tells the whole story: network reachable, but high attack complexity, user interaction required, and impact capped at *low integrity* and *low availability* with no confidentiality loss. This is a phishing enabler at worst, not a browser RCE. For a 10,000-host fleet on managed Chrome with auto-update, this rides the normal release train.

Sources.

1. Chrome Releases — Stable Channel Update
2. NVD entry (pending)
3. MITRE CVE record
4. CWE-451: UI Misrepresentation of Critical Information
5. CISA Known Exploited Vulnerabilities catalog
6. FIRST EPSS lookup
7. Chromium Security — Severity Guidelines
8. Chrome Enterprise policy — SafeBrowsingProtectionLevel

Run on each Windows endpoint (or via your RMM / Intune / SCCM script deployment) as any user — no admin needed. Invoke directly: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-14139.ps1. Outputs VULNERABLE, PATCHED, or UNKNOWN and sets exit code 1/0/2 respectively for RMM rollup.

#Requires -Version 5.0
# Check-CVE-2026-14139.ps1
# Detects Chrome versions vulnerable to CVE-2026-14139 (TabStrip UI spoof).
# Patched build: 150.0.7871.47

$FixedVersion = [Version]'150.0.7871.47'

$ChromePaths = @(
    "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
    "${env:ProgramFiles(x86)}\Google\Chrome\Application\chrome.exe",
    "$env:LOCALAPPDATA\Google\Chrome\Application\chrome.exe"
) | Where-Object { $_ -and (Test-Path $_) }

if (-not $ChromePaths) {
    Write-Output 'UNKNOWN: Google Chrome not found on this host.'
    exit 2
}

$Status = 'PATCHED'
$Exit = 0

foreach ($p in $ChromePaths) {
    try {
        $v = [Version](Get-Item $p).VersionInfo.ProductVersion
        if ($v -lt $FixedVersion) {
            Write-Output "VULNERABLE: $p is $v (need >= $FixedVersion)"
            $Status = 'VULNERABLE'
            $Exit = 1
        } else {
            Write-Output "OK: $p is $v"
        }
    } catch {
        Write-Output "UNKNOWN: could not read version for $p ($_ )"
        if ($Status -eq 'PATCHED') { $Status = 'UNKNOWN'; $Exit = 2 }
    }
}

Write-Output "RESULT: $Status"
exit $Exit