EUVD-2026-50924
GHSA-wj46-px5j-vc7g
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network-delivered via social engineering (AV:N), mandatory user install action (UI:R), no attacker privileges needed (PR:N), integrity impact only via UI deception (I:L), no confidentiality or availability consequence.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Incorrect security UI in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)
AnalysisAI
UI spoofing in Google Chrome's Extensions subsystem (all versions prior to 151.0.7922.72) allows an attacker who tricks a user into installing a crafted malicious extension to misrepresent critical security indicators within the browser interface. The flaw stems from incorrect security UI rendering in the Extensions component (CWE-451), enabling deceptive presentation of extension trust signals or permissions. No public exploit has been identified at time of analysis and EPSS is 0.10% (1st percentile), aligning with Chromium's own internal 'Low' severity rating; however, the ubiquitous deployment footprint of Chrome elevates the aggregate exposure.
Technical ContextAI
The vulnerability resides in the Extensions security UI layer of Google Chrome, classified under CWE-451 (User Interface Misrepresentation of Critical Information). This CWE class covers flaws where security-sensitive UI elements - such as permission dialogs, trust badges, or identity indicators - are rendered inaccurately, allowing attackers to manipulate what users perceive as safe or trusted. The affected product is Google Chrome for desktop (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) across all versions below 151.0.7922.72. The technical internals are tracked at issues.chromium.org/issues/521601450, but that issue is not publicly disclosed; the precise rendering defect is therefore inferred from the description and CWE classification. The Extensions API in Chrome grants extensions the ability to modify browser UI surfaces, and a failure in how the security UI validates or displays extension metadata is the root cause class.
RemediationAI
The primary remediation is to update Google Chrome to version 151.0.7922.72 or later, which contains the vendor-released patch confirmed via the Chrome Releases blog at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's automatic update mechanism handles this for most consumer endpoints; administrators should verify deployment via chrome://settings/help or fleet management tooling. Where immediate patching is not feasible, organizations using Chrome Browser Cloud Management or Windows Group Policy can enforce an extension allowlist (ExtensionInstallAllowlist / ExtensionInstallBlocklist policies), which blocks installation of unapproved extensions and directly eliminates the attack surface - the trade-off is that users lose the ability to self-install extensions outside the approved list.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today