EUVD-2026-40797
GHSA-4875-wjv5-3wm4
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Crafted page delivered over network requires only user navigation (UI:R); UI spoofing yields low integrity impact (I:L) with no confidentiality or availability effect and no scope change.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Inappropriate implementation in DarkMode in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
UI spoofing in Google Chrome's DarkMode implementation (all versions prior to 150.0.7871.47) enables remote attackers to misrepresent page content or interface elements by serving a crafted HTML page to a victim. The flaw is classified under CWE-451 (UI Misrepresentation of Critical Information), meaning the rendering pipeline fails to present information accurately, potentially deceiving users into unsafe actions such as credential entry or approval of deceptive prompts. No public exploit has been identified at time of analysis, EPSS is 0.18% (8th percentile), and CISA's SSVC framework rates exploitation as none - signals that collectively place this at low operational priority despite its network reachability.
Technical ContextAI
CWE-451 (User Interface Misrepresentation of Critical Information) describes vulnerabilities where a product's rendering logic fails to present information accurately, enabling an attacker to craft content that misleads a user about the true state of the interface. In this case, Chrome's DarkMode subsystem - which applies color inversion or theming to web content - contains an inappropriate implementation that can be triggered by a specially crafted HTML page to spoof visual UI elements. These elements could include security indicators, dialog boxes, or address bar representations. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop builds across platforms prior to the 150.0.7871.47 stable release. The Chromium issue tracker reference (issues.chromium.org/issues/513698452) documents the internal bug, though the detailed technical root cause may not be fully public.
RemediationAI
The primary fix is to upgrade Google Chrome to version 150.0.7871.47 or later, available via Chrome's built-in automatic update mechanism or directly from the stable channel release notes at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. For managed enterprise environments where immediate deployment is constrained, a compensating control is to disable or restrict access to untrusted external web content through proxy filtering or URL category blocking, which reduces the attack surface by preventing users from reaching attacker-controlled pages - at the cost of reduced browsing capability. Disabling DarkMode via Chrome policy (ForceDarkModeEnabled set to false) may also reduce exposure to this specific code path, though this is not confirmed as a complete mitigation and carries usability impact for users relying on accessibility or low-light settings. Given the low severity and absence of active exploitation, this vulnerability fits comfortably within standard patch cycle timelines.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today