EUVD-2026-40551
GHSA-rh68-cfmc-8xfw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network delivery via HTML page (AV:N), no auth needed (PR:N), user must visit the page (UI:R), UI spoofing yields low integrity impact with no confidentiality or availability effect.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
UI spoofing in Google Chrome Enterprise prior to version 150.0.7871.47 allows unauthenticated remote attackers to deceive users into believing they are interacting with legitimate browser UI by serving a crafted HTML page. The root cause is insufficient validation of untrusted HTML input within Chrome's Enterprise component (CWE-20), enabling an attacker to manipulate visual elements such as address bars, dialog prompts, or permission requests. No public exploit has been identified at time of analysis and EPSS sits at 0.21% (11th percentile), indicating low current exploitation probability despite a network-accessible attack vector.
Technical ContextAI
CWE-20 (Improper Input Validation) is the root cause: the Enterprise-specific code path in Google Chrome fails to adequately sanitize or validate HTML input before rendering UI elements, permitting attacker-controlled content to influence trusted browser chrome (the browser's own interface, distinct from web content). This class of vulnerability typically manifests as an attacker being able to render convincing imitations of browser dialogs, security indicators, or address bar content, undermining the browser's fundamental security boundary between attacker-controlled web content and trusted browser UI. The affected product is Google Chrome (Enterprise variant) running all versions prior to 150.0.7871.47 on desktop platforms. No CPE string was provided in the source data, but the EUVD entry and Chrome release advisory confirm the version boundary.
RemediationAI
The primary fix is to update Google Chrome to stable channel version 150.0.7871.47 or later, as documented in the vendor's stable channel release advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Enterprise administrators managing Chrome via policy should push this update through their endpoint management solution (Google Admin Console, Intune, or equivalent) with priority for user populations exposed to untrusted web content. A compensating control while patching is underway is to enforce Chrome's Safe Browsing Enhanced Protection mode via Enterprise policy, which may reduce the likelihood of users reaching attacker-controlled pages; however, this does not remediate the underlying input validation flaw. Restricting navigation to allowlisted domains via Chrome Enterprise URL filtering policies can also reduce attack surface, though at the cost of user productivity. No workaround fully eliminates the vulnerability without patching.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today