What is the CVSS score of CVE-2026-8019?

CVE-2026-8019 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-8019?

Yes, a patch is available for CVE-2026-8019. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-8019

EUVD-2026-28141 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-05-06 Chrome

Information Disclosure Google

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

vuln.today AI

5.4 MEDIUM

UI spoofing (CWE-451) carries low integrity impact over no availability impact; user interaction required but no privileges or elevated complexity needed.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 23:15 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

5.4 (MEDIUM)

CVE Published

May 06, 2026 - 18:13 nvd

UNKNOWN (no severity yet)

CVE Published

May 06, 2026 - 18:13 nvd

MEDIUM 5.4

DescriptionCVE.org

Insufficient policy enforcement in WebApp in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing via insufficient WebApp policy enforcement in Google Chrome prior to 148.0.7778.96 allows a remote attacker to mislead users about the trustworthiness of browser UI elements by delivering a crafted HTML page. All Chrome users on versions below 148.0.7778.96 are affected across desktop platforms, including those on Red Hat and SUSE Linux distributions. No active exploitation has been identified (SSVC: none; EPSS 0.05%, 16th percentile), and the patch is vendor-confirmed available in the stable channel release.

Technical ContextAI

CWE-451 (UI Misrepresentation of Critical Information) describes failures to accurately present security-relevant information to users, allowing attacker-controlled content to masquerade as trusted UI elements. In this case, Chrome's WebApp component - which handles Progressive Web App (PWA) presentation and isolated browser contexts - fails to enforce policies that distinguish authentic browser chrome from attacker-injected content. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome releases across platforms prior to the patched version 148.0.7778.96. The vulnerability enables a crafted HTML page to generate UI elements visually indistinguishable from legitimate browser or OS dialogs, undermining the visual trust model users rely on to assess page authenticity.

RemediationAI

Upgrade Google Chrome to version 148.0.7778.96 or later, which is the vendor-confirmed patched release per the stable channel advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. On Linux distributions using packaged Chrome (Red Hat, SUSE), apply the updated package from the respective vendor repositories once backported packages are available. If immediate upgrade is not possible, restricting access to untrusted or external web content via enterprise policy (e.g., URL allowlists via Chrome Browser Cloud Management or Group Policy) can reduce exposure, though this will impact general web browsing functionality. Disabling Progressive Web App (WebApp) installation via the policy 'WebAppInstallForceList' or 'DefaultWebAppInstallation' does not fully eliminate the attack surface, as the WebApp component is involved in rendering rather than solely installation. Chromium issue 498353173 may contain additional technical mitigations once made public.