What is the CVSS score of CVE-2026-18018?

CVE-2026-18018 has a contested CVSS base score of 4.0 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-18018?

Yes, a patch is available for CVE-2026-18018. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-18018

EUVD-2026-50944 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-07-30 Chrome

GHSA-fm8q-cqfv-58rj

Information Disclosure Google Microsoft

Medium

Disputed · 4.0 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

4.0 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

2.8 LOW

Local file placement implies existing access (PR:L); UI spoofing requires victim to observe the interface (UI:R); integrity is the only realistic impact for CWE-451.

3.1 AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

2.8 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 15:40 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:26 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:26 cve.org

MEDIUM 4.0

DescriptionCVE.org

Inappropriate implementation in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform UI spoofing via a malicious file. (Chromium security severity: Low)

AnalysisAI

UI spoofing in the Google Chrome Updater component on Windows (prior to 151.0.7922.72) enables a local attacker to present a falsified interface to users by placing a malicious file in a location the Updater processes. Chromium's own team rates this 'Low' severity, consistent with the 4.0 CVSS score, EPSS of 0.10% (1st percentile), and SSVC exploitation status of 'none'. No public exploit exists at time of analysis, and a vendor-confirmed patch is available in Chrome 151.0.7922.72.

Technical ContextAI

The affected component is the Google Chrome Updater (Google's Omaha update agent) running on Windows, identified via CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*. CWE-451 (UI Misrepresentation of Critical Information) describes the root cause class: the implementation fails to sufficiently validate or isolate file inputs that influence how update-related UI is rendered or displayed, allowing an adversary-controlled file to alter what the user sees during an update interaction. This class of flaw is distinct from code execution or privilege escalation - the primary damage is deceiving the user rather than directly compromising system state, making it a social-engineering enabler rather than a direct exploit primitive.

RemediationAI

Upgrade Google Chrome for Windows to version 151.0.7922.72 or later; this is confirmed as the vendor-released patch per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism will deliver this patch to most consumer endpoints without manual intervention, so the primary action for enterprise administrators is to verify that managed deployments have reached 151.0.7922.72 or higher via group policy reporting or endpoint management tooling. As a compensating control where immediate patching is delayed, restricting local write access to directories accessed by the Chrome Updater process can reduce exposure - note that this may also interfere with legitimate update processes. No workaround fully eliminates the risk without the patch.