Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2026-14077: Select Your Own Origin - Spoofing Chrome's Address Bar

pwn.ai | vulnerability | Medium | CVE-2026-14077 | #ai-security | #vulnerability-research | #browser-security | #phishing | #poc | #chrome | #cve-2026-14077 | #ui-spoofing

Summary

pwn.ai's CVE-2026-14077: an HTML select positioned partly above the viewport let a page draw native UI over Chrome's toolbar, spoofing the omnibox for a convincing fake download flow.
CVE
CVE-2026-14077
CVSS
4.3
Published
Collected

original ↗

Related coverage

High · vulnerability · nebusec.ai
Longinus: 2 Boundaries in One Bug, Piercing Chrome’s Renderer and V8 Sandbox with a Single Vulnerability, CVE-2026-6307
NebuSec details CVE-2026-6307 (Longinus): a single V8 TurboFan bug yields arbitrary read/write in the heap sandbox and escapes it to write outside, piercing Chrome's renderer.
High · vulnerability · nebusec.ai
How an Omitted Write Barrier in V8 Turns Into RCE in Chrome: CVE-2026-5865
NebuSec explains CVE-2026-5865: an omitted write barrier in V8's Maglev compiler lets the garbage collector miss an object, yielding fakeobj and RCE against Chrome.
research · portswigger.net
Abusing Chrome's XSS auditor to steal tokens
Gareth Heyes abuses Chrome's XSS Auditor block mode as a side-channel oracle, brute-forcing values such as user IDs embedded in inline scripts and stealing tokens. Includes working PoC code.
research · portswigger.net
Exposing Intranets with reliable Browser-based Port scanning
Gareth Heyes builds a reliable browser-based port scanner, distinguishing open ports via Chrome's chrome-error:// behavior and counting iframe onload events.
research · idnsec.com
Mitigating RCE Impact Like in OpenAI Hack with Defense-in-Depth
Using HacktronAI's OpenAI Discourse hack disclosure, this article covers sandboxing, runtime protection, and AI-assisted defense to shrink the blast radius of RCE across interconnected apps.
research · nebusec.ai
Check Your Motor Oil Before Turbocharging: CVE-2026-7899, When V8's Optimization Engine Builds Up Carbon
This research reveals deep compiler-level optimization pitfalls in modern JIT/WASM engines that lead to renderer sandbox escapes.
back