Exploitation ongoing with high activity in latest observed window (2 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Inappropriate implementation in Select in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 2 products
Chrome just fixed a very cute URL spoofing vulnearbility on its latest release found by Pwn: CVE-2026-14077 A tall <select> partly above the viewport made Chrome paint over its omnibox. Details below https://t.co/yc5IrYhKln
Post summary
The post announces a Chrome patch for a CVE-2026-14077 URL spoofing vulnerability, noting a specific UI element that was the attack vector.
🚨 Chrome'da keşfedilen CVE-2026-14077 açığı, sayfa içinde uzun bir <select> öğesiyle adres çubuğunda sahte URL gösterilmesine neden olabiliyordu. Bu durum phishing saldırılarında kullanılıyordu. Google, açığı Chrome 150 sürümünde düzeltti. https://t.co/byKAOyiJJo
Post summary
CVE-2026-14077 enabled phishing by showing fake URLs in Chrome's address bar, was actively exploited, and was fixed in Chrome 150.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | apple | macos | - | - | - |
| App | chrome | - | - | - |