EUVD-2026-40764
GHSA-jp9x-52hw-x955
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack delivered over network via crafted page requiring active user visit (UI:R); URL bar spoofing produces low integrity impact only with no confidentiality or availability consequence.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in Select in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Omnibox (URL bar) spoofing in Google Chrome on macOS prior to version 150.0.7871.47 enables a remote attacker to display a falsified URL in the browser's address bar by delivering a crafted HTML page exploiting an inappropriate Select element implementation. The deception targets the user's trust in the origin indicator - the primary browser security signal - making this a phishing and social engineering enabler rather than a direct code execution or data exfiltration vector. No public exploit exists and EPSS exploitation probability stands at 0.17% (7th percentile), with no confirmed active exploitation; vendor-released patch is available in Chrome 150.0.7871.47.
Technical ContextAI
The flaw resides in Google Chrome's Chromium rendering engine on macOS, specifically in how the Select HTML form element is implemented at the browser UI layer. CWE-451 (User Interface Misrepresentation of Critical Information) identifies the root cause class: security-critical browser chrome - in this case the Omnibox - can be manipulated to display content inconsistent with the actual loaded origin. This breaks the origin-based trust model underpinning web security; users and password managers rely on the Omnibox as an authoritative origin indicator. The CPE string (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) identifies the affected product as the Chrome application itself. Notably, the vulnerability is platform-scoped to macOS, suggesting the Select implementation diverges from other platforms in its handling of UI rendering interactions with the address bar.
RemediationAI
The primary remediation is upgrading Google Chrome on macOS to version 150.0.7871.47 or later, which contains the vendor-released patch. The fix is documented in the Google Chrome stable channel release advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's built-in auto-update mechanism delivers this fix automatically in most environments; enterprise administrators should verify fleet compliance via endpoint management tooling (e.g., Google Admin Console or MDM) to confirm all macOS endpoints are on 150.0.7871.47 or later. As a compensating control prior to patching, organizations can remind users to verify URLs through secondary means (e.g., manual inspection after navigation, Safe Browsing warnings), though these behavioral mitigations are not reliable substitutes for the patch. No adverse side effects are associated with upgrading to 150.0.7871.47.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today