EUVD-2026-40674
GHSA-5xrh-hwvg-g4q9
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
UI spoofing has no direct confidentiality or availability impact; availability impact in the provided vector is not supported by the CWE-451 description.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Media UI in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
UI spoofing in Google Chrome's Media UI component on ChromeOS allows a remote attacker to manipulate what a user sees by delivering a crafted HTML page and social-engineering the victim into performing specific in-browser UI gestures. Affected versions are all Chrome on ChromeOS prior to 150.0.7871.47. While classified Medium severity (CVSS 4.2), the practical risk is constrained by the requirement for active user interaction and the ChromeOS-only scope; no public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
The vulnerability resides in Chrome's Media UI subsystem - the browser layer that renders media controls (play, pause, fullscreen, picture-in-picture, etc.) - specifically on ChromeOS. CWE-451 (User Interface Misrepresentation of Critical Information) describes the root cause class: the implementation incorrectly renders or positions UI elements in a way that can be exploited to mislead the user about the origin, identity, or trustworthiness of displayed content. This is a classic UI redressing/spoofing class, distinct from clickjacking but related - the attacker causes the browser to display a deceptive media overlay that masks or mimics legitimate interface elements. The affected product string from EUVD narrows scope to Chrome versions below 150.0.7871.47. The ChromeOS-specific nature suggests the flaw may involve platform-level media integration APIs (e.g., ChromeOS system media controls or the picture-in-picture window manager) that have no equivalent on other platforms.
RemediationAI
The primary remediation is to update Google Chrome on ChromeOS to version 150.0.7871.47 or later, which contains the vendor-released patch for this issue. ChromeOS devices managed via enterprise admin consoles should be forced to this channel update through the Google Admin Console device management policy. The vendor advisory detailing this fix is available at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. As a compensating control prior to patching, enterprise administrators can restrict access to untrusted external web content through Chrome's managed browsing policies (e.g., URL allowlisting or Safe Browsing enforcement), which raises the bar for delivering the crafted HTML page required to exploit this vulnerability. Disabling picture-in-picture or media overlay features via Chrome policy flags may reduce attack surface for the Media UI component specifically, though this would impact legitimate media workflows.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today