What is the CVSS score of CVE-2026-18008?

CVE-2026-18008 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-18008?

Yes, a patch is available for CVE-2026-18008. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-18008

EUVD-2026-50934 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-07-30 Chrome

GHSA-8f3w-7pcr-g8rx

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered spoofing requires no attacker privileges and mandates user interaction; scope is unchanged with only low integrity impact and no confidentiality or availability effects.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 18:44 vuln.today

CVSS changed

Jul 30, 2026 - 16:37 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:26 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:26 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Settings in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via malicious network traffic. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome's Settings component (versions prior to 151.0.7922.72) enables remote attackers to misrepresent critical interface elements to victims via malicious network traffic, requiring user interaction to trigger. EPSS at 0.15% (5th percentile) and CISA SSVC exploitation rating of none align with the Chromium team's own Low severity classification, making this a low-urgency issue despite its network-accessible attack vector. Google has released a patch in stable channel version 151.0.7922.72; no public exploits are identified at time of analysis.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) describes flaws where software renders misleading UI elements that can deceive users into unsafe decisions or false security assumptions. The vulnerability resides specifically in the Settings component of Google Chrome (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*), where inappropriate implementation allows attacker-controlled network traffic to influence how Settings UI elements are displayed. This is a browser-layer rendering flaw, not a memory corruption or code execution class issue - the root cause is logic or presentation handling in Settings that fails to sanitize or correctly process externally influenced data before rendering it to the user.

RemediationAI

Upgrade Google Chrome to version 151.0.7922.72 or later, as confirmed by the vendor's stable channel update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome auto-updates by default; users can verify the installed version at chrome://settings/help and restart the browser to apply any pending update. If an immediate upgrade is operationally blocked, restricting user access to untrusted or adversary-controlled network environments reduces exposure, though this is not a practical mitigation for general browsing use cases. Given the SSVC exploitation:none rating and Chromium Low severity classification, this vulnerability does not warrant out-of-band patching outside normal monthly patch cycles.