EUVD-2026-35266
GHSA-q7vr-j5wc-2xch
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Lifecycle Timeline
4DescriptionNVD
Insufficient validation of untrusted input in Input in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
UI spoofing in Google Chrome prior to 149.0.7827.103 enables remote unauthenticated attackers to deceive users into interacting with falsified browser interface elements via a crafted HTML page. The vulnerability exploits insufficient input validation in Chrome's Input component (CWE-20), carrying a moderate CVSS 5.4 with confirmed low confidentiality impact and an Information Disclosure tag suggesting data exposure risk through spoofed UI surfaces such as fake dialogs or address bar manipulation. EPSS probability is very low at 0.05% (15th percentile), no public exploit has been identified, and no CISA KEV listing exists at time of analysis.
Technical ContextAI
The flaw resides in Google Chrome's Input handling subsystem, where CWE-20 (Improper Input Validation) is the root cause class - meaning Chrome fails to adequately sanitize or gate untrusted HTML-derived input before it influences how the UI is composed or displayed. This class of weakness in browser input pipelines typically manifests as the browser rendering attacker-controlled content in a privileged UI context (e.g., address bar, permission dialogs, security indicators), enabling spoofing attacks. The CVSS vector (AV:N/AC:L) confirms the vulnerable code path is reachable over the network with low attack complexity once the victim navigates to a crafted page. All Google Chrome desktop releases prior to version 149.0.7827.103 are affected, per the EUVD-2026-35266 entry and the Chrome Stable Channel advisory. No CPE strings were provided in the source data; version scope is derived from EUVD and NVD description.
RemediationAI
Update Google Chrome to version 149.0.7827.103 or later immediately via Chrome's built-in update mechanism (Settings → Help → About Google Chrome triggers an update check) or through enterprise deployment tooling (Google Admin Console, GPO, or a third-party patch management platform). The vendor-released patch is confirmed available per the Stable Channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. For organizations unable to patch immediately, a practical compensating control is to enforce web content filtering that blocks navigation to unknown or untrusted external domains, reducing the likelihood of a victim reaching an attacker-hosted page - this carries the trade-off of restricting legitimate browsing and should be scoped carefully. Restricting Chrome via policy to disable JavaScript on untrusted origins is another partial mitigation, though it may break legitimate web applications. Neither workaround eliminates the root vulnerability and patching remains the definitive fix.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today