What is the CVSS score of CVE-2026-8015?

CVE-2026-8015 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-8015?

Yes, a patch is available for CVE-2026-8015. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-8015

EUVD-2026-28133 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-05-06 Chrome

Information Disclosure Google

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

vuln.today AI

4.3 MEDIUM

UI spoofing via crafted HTML requires no attacker privileges (PR:N) and victim page visit (UI:R); no integrity or availability impact arises from information misrepresentation alone.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 00:31 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

5.4 (MEDIUM)

CVE Published

May 06, 2026 - 18:13 nvd

UNKNOWN (no severity yet)

CVE Published

May 06, 2026 - 18:13 nvd

MEDIUM 5.4

DescriptionCVE.org

Inappropriate implementation in Media in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome's Media component prior to version 148.0.7778.96 enables remote attackers to deceive users via a specially crafted HTML page that abuses inappropriate media rendering behavior to misrepresent browser interface elements. The CVSS vector (PR:N/UI:R/S:U) indicates unauthenticated remote exploitation is possible but requires the victim to visit a malicious page, with limited confidentiality impact. SSVC classifies exploitation as none and automatable as no; EPSS at 0.06% (18th percentile) corroborates low exploitation likelihood, and no public exploit or active exploitation has been identified.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) describes flaws where security-critical UI state is incorrectly displayed, allowing attackers to deceive users about what they are interacting with. The vulnerability resides in Chrome's Media component - the subsystem responsible for HTML5 audio/video playback, media session APIs, fullscreen transitions, and related rendering paths. An 'inappropriate implementation' in this context typically means the media layer improperly handles UI surface transitions (e.g., fullscreen overlays, permission prompts, or address bar rendering), creating a surface where a crafted HTML page can render a spoofed browser UI element indistinguishable from a legitimate one. Affected products are identified via CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all versions prior to 148.0.7778.96, with downstream impact noted for Red Hat and SUSE Linux distribution packages.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later, which resolves this vulnerability per the official stable channel release advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Enterprise environments managing Chrome via policy should push the update through their standard fleet management tooling. Red Hat and SUSE users should apply the respective distribution-level package updates when available. No meaningful technical workaround exists for browser-side UI spoofing beyond upgrading; user awareness training to recognize suspicious fullscreen or overlay prompts provides a limited compensating control with no technical side effects, though it is insufficient as a sole mitigation.