Skip to main content

Google Chrome CVE-2026-17812

| EUVDEUVD-2026-50761 MEDIUM
User Interface (UI) Misrepresentation of Critical Information (CWE-451)
2026-07-30 Chrome GHSA-qgxw-xv94-599v
Google Information Disclosure Red Hat Suse
Medium
Disputed · 5.4 Vendor: Chrome
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (Chrome) PRIMARY
5.4 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
vuln.today AI
4.3 MEDIUM

Network delivery via crafted HTML with no privileges needed; UI:R required; A:N because UI spoofing does not cause service disruption, contradicting the upstream A:L metric.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
CRITICAL
qualitative
Red Hat
5.4 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
Low

Lifecycle Timeline

5
Analysis Generated
Jul 31, 2026 - 14:25 vuln.today
CVSS changed
Jul 31, 2026 - 14:22 NVD
5.4 (MEDIUM)
Patch available
Jul 30, 2026 - 02:02 EUVD
CVE Published
Jul 30, 2026 - 00:19 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 30, 2026 - 00:19 cve.org
MEDIUM 5.4

DescriptionCVE.org

Inappropriate implementation in DigitalCredentials in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing via the DigitalCredentials API in Google Chrome prior to 151.0.7922.72 allows a remote, unauthenticated attacker to deceive users about the legitimacy or origin of credential-related dialogs through a crafted HTML page. The vulnerability stems from an inappropriate implementation in Chrome's handling of the DigitalCredentials web API (CWE-451), enabling misrepresentation of critical UI information. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Craft malicious HTML abusing DigitalCredentials API
Delivery
Deliver link to victim via phishing or malvertising
Exploit
Victim navigates to page in unpatched Chrome
Execution
Spoofed credential dialog rendered in browser UI
Persist
Victim submits identity credentials believing request is legitimate
Impact
Attacker captures disclosed credential data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The victim must navigate to a crafted HTML page under attacker control, making user interaction (UI:R per CVSS) a hard prerequisite - drive-by exploitation without any user action is not possible. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The NVD CVSS 3.1 score of 5.4 (Medium) is consistent with a UI-based spoofing issue: network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), but requiring user interaction (UI:R), with unchanged scope (S:U) and limited confidentiality and availability impacts. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker hosts a crafted HTML page that abuses the DigitalCredentials API to render a spoofed browser-native credential request dialog, making it appear as though a trusted identity provider or government service is requesting credential presentation. A victim browsing to the page - potentially via phishing link or malvertising - interacts with the spoofed dialog and submits sensitive identity details believing the request to be legitimate. …
Remediation The primary remediation is updating Google Chrome to version 151.0.7922.72 or later, as confirmed by the Chrome Stable Channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-451 – User Interface (UI) Misrepresentation of Critical Information

View all
CVE-2025-8043 CRITICAL POC
9.8
CVE-2024-55889 HIGH POC
7.2
CVE-2025-7021 MEDIUM POC
6.5
CVE-2022-2800 MEDIUM POC
6.1
CVE-2026-0907 CRITICAL
9.8
CVE-2026-0906 CRITICAL
9.8
CVE-2026-2634 CRITICAL
9.8
CVE-2016-9467 MEDIUM POC
5.3

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2023-4966 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Package Hub 15 SP7 Fixed
openSUSE Leap 16.0 Fixed
SUSE Package Hub 15 SP7 Affected

Share

CVE-2026-17812 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy