What is the CVSS score of CVE-2026-18007?

CVE-2026-18007 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-18007?

Yes, a patch is available for CVE-2026-18007. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-18007

EUVD-2026-50933 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-07-30 Chrome

GHSA-gc2m-4rpx-mjq6

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network delivery via crafted page (AV:N), no complexity or privilege required (AC:L, PR:N), user must visit page (UI:R), impact limited to UI integrity misrepresentation with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

0.0 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 18:43 vuln.today

CVSS changed

Jul 30, 2026 - 16:37 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:26 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:26 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Input in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome for Android (prior to 151.0.7922.72) enables remote unauthenticated attackers to present misleading interface elements to users through a crafted HTML page. The flaw stems from an inappropriate implementation in Chrome's input handling on Android, classified under CWE-451 (UI Misrepresentation of Critical Information), meaning the browser fails to correctly represent critical UI state to the user. No public exploit code exists and CISA has not listed this in KEV; EPSS is extremely low at 0.16% (6th percentile), consistent with Chromium's own Low severity classification.

Technical ContextAI

CWE-451 describes failures in which the user interface misrepresents critical information, allowing an attacker to cause the victim to make security-relevant decisions based on false UI context - commonly used in address-bar spoofing, permission dialog manipulation, or input field overlay attacks. The vulnerability is specific to Chrome's Android implementation of input handling, suggesting the spoofing vector may involve on-screen keyboard interactions, text input overlays, or touch-based UI elements that behave differently from the desktop counterpart. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* scoped to Android, with all Chrome for Android versions prior to 151.0.7922.72 considered vulnerable. The Chromium issue tracker reference (issues.chromium.org/issues/522404101) is the upstream bug record.

RemediationAI

Update Google Chrome for Android to version 151.0.7922.72 or later via the Google Play Store or Chrome's built-in update mechanism; this is the vendor-confirmed patched release per the Chrome stable channel advisory at chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. No viable workaround exists that preserves normal browsing functionality, as the flaw is in core input handling. As a compensating control, organizations managing Android device fleets via MDM can enforce a minimum Chrome version policy to block use of unpatched versions. Users who cannot immediately update should avoid visiting untrusted HTML pages on Android Chrome, though this significantly limits utility. Enabling Safe Browsing in Chrome settings provides partial mitigation against known malicious pages but does not address the underlying implementation flaw.