CVE-2026-14141

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47

Description An incorrect security UI implementation in the Document Picture-in-Picture feature allows a remote attacker to perform domain spoofing by using a crafted HTML page. Domain spoofing is a technique used to deceive users into believing they are interacting with a different, trusted domain than the one actually serving the content.

Recommendations Update Google Chrome on Android to version 150.0.7871.47 or later.