EUVD-2026-40670
GHSA-2fjr-r86h-fpw3
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
AC:H reflects mandatory prior renderer compromise; UI:R captures required victim interaction; I:L for bounded UI spoofing with no confidentiality or availability impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Incorrect security UI in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
UI spoofing in Google Chrome's Passwords component (versions prior to 150.0.7871.47) allows an attacker who has already achieved renderer process compromise to manipulate security-critical password UI elements via a crafted HTML page. This is a chained exploitation scenario - not a standalone initial-access vector - as the attacker must first compromise the renderer through a separate vulnerability before leveraging this flaw. EPSS at 0.21% (11th percentile) and no CISA KEV listing confirm no observed exploitation at scale; Chromium's internal classification is Medium severity.
Technical ContextAI
CWE-451 (User Interface Misrepresentation of Critical Information) describes failures where the UI does not accurately convey security-relevant state to the user. Chrome's architecture deliberately sandboxes the renderer process from privileged browser internals; however, this vulnerability allows a compromised renderer to interfere with how the Passwords component - Chrome's built-in password manager UI - renders and presents information to the user. By supplying a crafted HTML page, the attacker can cause the Passwords UI to display spoofed or misleading security indicators, potentially tricking the user into believing a malicious prompt is legitimate. No CPE strings were provided in the input, but the EUVD-2026-40670 affected version range explicitly identifies all Chrome desktop versions below 150.0.7871.47 as vulnerable.
RemediationAI
Upgrade Google Chrome to version 150.0.7871.47 or later, confirmed as the patched stable release per the Chrome release advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism will deliver this to most users automatically; enterprise administrators should verify that managed update policies enforce the minimum version threshold. No documented workarounds exist for this specific flaw. As a compensating control for environments where patching is delayed, disabling Chrome's built-in password manager via enterprise policy (setting PasswordManagerEnabled to false) removes the vulnerable UI surface entirely, though at the cost of removing native credential management for end users who would need an alternative solution. Separately, hardening against renderer exploitation vectors (restricting navigation to untrusted sites, enforcing Chrome's site isolation and sandbox policies) reduces the likelihood of the prerequisite renderer compromise that this vulnerability depends upon.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today