EUVD-2026-30378
GHSA-qf67-qcvf-27gx
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
UI spoofing via network-reachable crafted page with mandatory user interaction; no direct integrity or availability impact from spoofing itself.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Incorrect security UI in Fullscreen in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
UI spoofing in Google Chrome's fullscreen mode exposes users to phishing and deception attacks via crafted HTML pages that manipulate security-critical browser UI elements. All Chrome desktop releases prior to 148.0.7778.168 are affected (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*). No public exploit identified at time of analysis; EPSS at 0.06% (18th percentile) and SSVC exploitation status of 'none' collectively indicate low real-world exploitation pressure despite Chrome's ubiquitous deployment footprint.
Technical ContextAI
CWE-451 ('User Interface Misrepresentation of Critical Information') describes flaws where security-critical UI signals - such as the browser address bar, padlock icon, or origin indicators - are rendered incorrectly or suppressed, misleading users about the trust context they are operating in. Chrome's fullscreen API allows web content to occupy the entire display, which by design hides standard browser chrome. This vulnerability indicates that Chrome's security UI overlay mechanism - responsible for showing the actual origin or exit-fullscreen prompts during fullscreen sessions - could be manipulated by a crafted HTML page to display incorrect or misleading security information. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome desktop variants across platforms, consistent with Red Hat and SUSE also tagging this issue, indicating cross-platform Linux exposure as well.
RemediationAI
The primary fix is upgrading Google Chrome to version 148.0.7778.168 or later, confirmed as the patched release via the Chrome stable channel advisory at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. Chrome's auto-update mechanism will deliver this patch to most users automatically; enterprise administrators should verify managed fleet versions via policy and force update if lagging. On Linux systems using Red Hat or SUSE packages, apply the vendor-provided updated Chrome package through the standard package manager once it reaches the relevant repositories. No specific workaround for the fullscreen UI spoofing issue exists short of disabling fullscreen API access via enterprise policy (Chrome's FullscreenAllowed policy set to false), though this may break legitimate fullscreen use cases such as video conferencing and media applications. Users unable to patch immediately should be advised to exit fullscreen (typically via Escape or F11) and verify the address bar when prompted for any sensitive information.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today