EUVD-2026-40523
GHSA-936f-wj2q-h6f5
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network-delivered via crafted page requiring one user navigation; no confidentiality or availability impact, only low integrity from visual UI deception.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
UI spoofing in Google Chrome before 150.0.7871.47 allows remote unauthenticated attackers to visually deceive users by serving a crafted HTML page that exploits a flaw in Chrome's CSS implementation. The flaw (CWE-451: UI Misrepresentation of Critical Information) enables attacker-controlled content to obscure or mimic trusted browser UI elements such as the address bar or security indicators, creating a credible phishing surface. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% (12th percentile) indicates minimal observed exploitation activity; however, Google's internal Chromium severity rating of 'High' reflects the significant phishing and credential-theft potential inherent in convincing browser UI spoofing.
Technical ContextAI
CWE-451 (User Interface Misrepresentation of Critical Information) describes weaknesses where security-relevant UI elements are rendered in a misleading or attacker-influenced manner. In Chrome's Blink rendering engine, the CSS implementation prior to 150.0.7871.47 contains an 'inappropriate implementation' that allows crafted stylesheets to manipulate the visual presentation in ways that cross the boundary between web content and trusted browser chrome. Common CSS-based UI spoofing primitives include viewport-filling fixed-position overlays, z-index stacking to occlude the address bar, and fullscreen API abuse to eliminate browser chrome entirely - any of which could be exploited to render convincing fake security dialogs or address bars. The affected scope is all Google Chrome desktop builds (Windows, macOS, Linux) prior to version 150.0.7871.47 per EUVD-2026-40523 and the Chrome stable channel advisory.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later, available through Chrome's built-in update mechanism (chrome://settings/help) or via enterprise deployment tools using the stable channel packages referenced in the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome auto-update is enabled by default on most consumer and managed installations, so confirming the installed version is sufficient for most environments. No CSS-level workaround directly mitigates the rendering flaw. For environments where immediate patching is delayed, user-awareness training to verify URLs via the keyboard-accessible address bar (Ctrl+L / Cmd+L bypasses overlay content) can reduce the phishing risk posed by UI spoofing attacks, though this is a compensating control with limited reliability and not a substitute for patching.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today