EUVD-2026-40617
GHSA-73h2-64hc-q23c
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
AC:H reflects the explicit prerequisite that the renderer process must already be compromised before this UI spoofing can occur, raising real-world attack complexity above the provided vector.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Media in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
UI spoofing in Google Chrome on Windows (prior to 150.0.7871.47) allows a remote attacker who has already compromised the renderer process to manipulate the browser interface via a specially crafted HTML page, potentially deceiving users into interacting with falsified content or controls. The vulnerability stems from an inappropriate implementation in the Media component and is classified as medium severity (CVSS 6.5). No public exploit code or active exploitation has been identified - EPSS sits at the 11th percentile (0.21%) and no CISA KEV listing exists - and a vendor patch is confirmed available in Chrome 150.0.7871.47.
Technical ContextAI
The flaw resides in Chrome's Media component on Windows, catalogued under CWE-284 (Improper Access Control). Chrome's multi-process architecture isolates rendering in sandboxed renderer processes, but this vulnerability abuses an inappropriate implementation detail in media handling that can be leveraged post-renderer-compromise to affect the browser's trusted UI surface - the chrome itself, not just page content. The affected CPE is Google Chrome on Windows, all versions prior to 150.0.7871.47, as confirmed by both the EUVD and the Google Chrome Releases advisory. CWE-284 indicates that access controls between process contexts or UI layers are not correctly enforced, allowing the compromised renderer to influence UI elements it should have no authority over.
RemediationAI
Update Google Chrome on Windows to version 150.0.7871.47 or later, which is confirmed to include the fix per the vendor advisory at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Enterprise deployments managed via Google Admin Console or Microsoft Group Policy should push the update through their standard Chrome update channels. Because exploitation requires prior renderer compromise, organisations that cannot immediately patch should prioritise mitigations targeting renderer exploitation vectors: enabling Chrome's Enhanced Protection mode in Safe Browsing, enforcing site isolation policies (--site-per-process is default in modern Chrome but should be verified), and blocking access to untrusted or external HTML content in high-risk environments. These mitigations reduce the likelihood of the renderer pre-compromise required to trigger this flaw, though they do not address the vulnerability itself.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today