EUVD-2026-28119Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
UI spoofing via installed extension yields limited confidentiality impact only; no availability impact is substantiated by the description, so A:N replaces the official A:L.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)
AnalysisAI
UI spoofing in Google Chrome's DevTools subsystem (all versions prior to 148.0.7778.96) enables a crafted browser extension to misrepresent critical UI elements to the victim, exploiting an inappropriate implementation classified as CWE-451. The attack requires social engineering the user into installing a malicious extension, after which the extension manipulates DevTools rendering to deceive the user about browser or page state. No active exploitation is confirmed (absent from CISA KEV), EPSS is negligible at 0.01% (3rd percentile), and SSVC rates exploitation as none with partial technical impact, placing this firmly in the low-priority tier despite the Medium CVSS score.
Technical ContextAI
The vulnerability resides in Chrome's DevTools subsystem - the integrated developer tooling exposed within the browser runtime. CWE-451 (User Interface Misrepresentation of Critical Information) identifies the root cause as the browser incorrectly rendering or presenting UI elements in a way that can be manipulated by extension-supplied content or API calls. Chrome extensions interact with DevTools through privileged extension APIs, and the inappropriate implementation allows a crafted extension to inject or alter UI representations within the DevTools interface, effectively spoofing security or state indicators. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome installations across platforms (Windows, macOS, Linux) prior to 148.0.7778.96. The Chromium issue tracker entry 496426191 is referenced but may be access-restricted, limiting public technical detail.
RemediationAI
Upgrade Google Chrome to version 148.0.7778.96 or later, the vendor-released patch documented at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will deliver this to most desktop users automatically; enterprise deployments should confirm update propagation via fleet management tooling. As a compensating control for managed environments, enforce an extension allow-list policy using the Chrome enterprise policy ExtensionInstallAllowlist, which prevents unauthorized extensions from being installed and eliminates the primary attack prerequisite entirely - the trade-off being reduced user flexibility in extension choice. Alternatively, disabling DevTools access via the DevToolsDisabled Chrome enterprise policy removes the vulnerable surface but impairs developer and IT workflows. Red Hat and SUSE users should apply the updated Chromium package from their distribution's security channels.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today