EUVD-2026-40648
GHSA-8236-6fh4-f974
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network-delivered via crafted page (AV:N/AC:L/PR:N), requires victim navigation (UI:R); UI misrepresentation yields only limited integrity impact with no confidentiality or availability consequence.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
UI spoofing in Google Chrome's Passwords component (all versions prior to 150.0.7871.47) enables remote, unauthenticated attackers to misrepresent critical interface elements to users via a specially crafted HTML page. The flaw stems from an inappropriate implementation (CWE-451) in Chrome's password management UI, meaning a malicious page can render deceptive credential-related prompts or overlays that appear to originate from the browser's trusted Passwords subsystem. No public exploit code has been identified and CISA SSVC rates active exploitation as none, making this a moderate-priority patching item rather than an emergency response.
Technical ContextAI
CWE-451 (User Interface Misrepresentation of Critical Information) describes flaws where an application fails to adequately distinguish trusted UI from attacker-controlled content. In Chrome's context, the Passwords component is responsible for rendering autofill prompts, credential save/update dialogs, and password manager overlays - all of which carry implicit user trust. An inappropriate implementation in this subsystem means a crafted HTML page can trigger, suppress, or impersonate these trusted UI elements, blurring the boundary between browser chrome (trusted UI frame) and web content (attacker-controlled). The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome versions on all platforms prior to the 150.0.7871.47 stable channel release. The Chromium security team rated this Medium severity, consistent with the limited direct system impact but meaningful potential for user deception.
RemediationAI
Upgrade Google Chrome to version 150.0.7871.47 or later, the vendor-released patch confirmed via the Chrome stable channel release at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome typically auto-updates, but enterprise fleet managers should verify deployment via policy tooling (Google Admin Console, Intune, or Puppet/Chef). For SUSE Linux environments, apply the updated Chromium package through the standard SUSE package manager once the distribution maintainer publishes the patched build. In the interim, organizations with high-sensitivity environments may consider disabling the Chrome Passwords/autofill feature via enterprise policy (PasswordManagerEnabled=false) as a compensating control; this removes the attack surface but also disables password autofill for all users, which carries usability trade-offs. There is no indication that the vulnerability is exploitable in headless or server-side Chrome deployments, so risk is limited to interactive desktop browser sessions.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today