Google Chrome CVE-2026-18008

The victim must be running Google Chrome prior to version 151.0.7922.72, and user interaction is required (UI:R per CVSS vector) - the spoofing effect manifests through the Settings interface, meaning the user must navigate to or open Settings during the attack window. The attacker must be able to influence network traffic reaching the victim's browser, implying a man-in-the-middle position, control of a network the victim is using, or a malicious server the browser is communicating with. Exploitation is not automatable per SSVC, confirming that reliable triggering requires deliberate user interaction rather than passive browser activity. No authentication is required of the attacker (PR:N), but the combination of required user interaction and network positioning limits opportunistic mass exploitation. Impact is strictly limited to UI integrity misrepresentation (I:L); no code execution, credential theft, or availability disruption is implied by available data.

The CVSS 3.1 score of 4.3 (Medium) captures a network-accessible vector (AV:N) with no privilege requirement (PR:N) but mandates user interaction (UI:R), ruling out automated mass exploitation. Impact is limited to low integrity (I:L) - no confidentiality or availability consequences are implied. EPSS at 0.15% (5th percentile) strongly corroborates minimal exploitation activity, and SSVC independently rates automatable:no and technical impact:partial. The vulnerability is absent from CISA KEV. Notably, the intelligence tags include 'Information Disclosure,' which conflicts with the CVSS C:N metric - this discrepancy is unexplained by available data and may reflect a tagging imprecision or an indirect leakage scenario not reflected in the base score. Combined signals uniformly indicate this is a theoretical risk suitable for normal patch cadence, not emergency response.

An attacker positioned to deliver malicious network traffic to a victim - such as through a rogue Wi-Fi access point, DNS hijacking, or a malicious web server - sends a crafted response that causes Chrome's Settings interface to render spoofed UI elements, potentially misleading the user into believing a security setting is active or a permission has been granted when it has not. The attack requires the user to interact with Chrome and encounter the manipulated Settings view (UI:R). No public exploit code has been identified at time of analysis.