EUVD-2026-40678
GHSA-cgj9-48jq-3g65
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
AC:H reflects the mandatory renderer pre-compromise prerequisite; all other metrics align with the provided vector since no auth, no confidentiality, and no availability impact apply.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in DataTransfer in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
UI spoofing in Google Chrome for Windows (prior to 150.0.7871.47) is enabled by insufficient input validation in the DataTransfer subsystem when the renderer process has already been compromised. A remote attacker who controls a compromised renderer can deliver a crafted HTML page that manipulates visual UI elements, potentially deceiving users into approving malicious permissions, revealing credentials, or performing unintended actions. No active exploitation has been confirmed (not in CISA KEV), and EPSS of 0.17% at the 7th percentile reflects minimal observed exploitation probability; however, exploitation as a second-stage payload in a renderer RCE chain remains a realistic concern for high-value targets.
Technical ContextAI
The DataTransfer API in Chromium underpins clipboard and drag-and-drop operations between web content and the host OS. On Windows, this subsystem fails to sufficiently validate untrusted input (CWE-20: Improper Input Validation), allowing a renderer-context attacker to inject or manipulate UI representations presented to the user - classic UI spoofing territory. This vulnerability is Windows-specific, suggesting the flaw may lie at the Chromium-Win32 interface layer for DataTransfer handling rather than in the cross-platform browser engine. Affected product per EUVD-2026-40678: Chrome versions below 150.0.7871.47 on Windows. The attack is inherently two-stage: it presupposes a separate renderer compromise vulnerability, consistent with Chrome's sandbox security model where the renderer is treated as an untrusted process.
RemediationAI
Upgrade Google Chrome on all Windows endpoints to version 150.0.7871.47 or later via the stable channel update documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome auto-updates in most consumer and enterprise deployments; administrators should verify managed devices have applied the update and confirm the installed version via chrome://settings/help. The Chromium issue tracker reference (https://issues.chromium.org/issues/514058439) may provide additional technical detail for validation. If immediate patching is blocked, enabling Chrome's enhanced Site Isolation (already on by default in modern Chrome) and restricting navigation to untrusted or unknown sites reduces renderer compromise risk - thereby limiting the prerequisite condition for this specific flaw. Note that blocking untrusted sites via content filtering does not eliminate risk if users visit compromised legitimate sites. No other vendor-documented workaround specific to the DataTransfer flaw has been identified.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today