EUVD-2026-50705
GHSA-6vmp-jgfm-6r3v
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Extension install requires active user interaction (UI:R); spoofing yields limited integrity impact (I:L) only; no confidentiality or availability impact applies.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Incorrect security UI in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Medium)
AnalysisAI
UI spoofing in Google Chrome's Extensions component enables an attacker who persuades a victim to install a malicious extension to misrepresent browser security indicators, affecting all Chrome desktop versions prior to 151.0.7922.72. The flaw (CWE-451) stems from incorrect rendering of security UI elements within the Extensions subsystem, granting a crafted extension the ability to deceive users about their browser's security state or extension permissions. No public exploit identified at time of analysis, and EPSS at 0.13% (3rd percentile) reflects very low exploitation probability; this CVE is not listed in CISA KEV.
Technical ContextAI
CWE-451 (User Interface Misrepresentation of Critical Information) describes failures where the UI does not faithfully communicate security-relevant state to the user, enabling deception. In Chrome's Extensions architecture, each extension can influence portions of the browser UI (toolbar icons, permission prompts, badge text, and overlay elements). The flaw in the Extensions security UI layer allows a crafted extension to present misleading security signals - such as falsely indicating a site is trusted, or masking permission states - bypassing the browser's intended security communication channel. Affected product scope per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all desktop Chrome builds before version 151.0.7922.72 across Windows, macOS, and Linux. The Chromium issue tracker reference (issues.chromium.org/issues/501854535) is not publicly disclosed, so technical implementation details of the flaw are not independently confirmed.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later via the browser's built-in update mechanism (Help > About Google Chrome) or through enterprise deployment tooling. The patch is confirmed available per the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. If immediate patching is not possible, the most effective compensating control is enforcing extension installation policies via enterprise policy (ExtensionInstallAllowlist / ExtensionInstallBlocklist) to restrict installations to a vetted allowlist, which directly addresses the prerequisite of installing a malicious extension. Disabling the ability for users to install extensions from outside the Chrome Web Store (via ExtensionInstallSources policy) reduces attack surface further but may impact legitimate workflows. Generic extension review processes and user awareness training are supplementary, not substitutes for patching.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today