What is the CVSS score of CVE-2026-8564?

CVE-2026-8564 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-8564?

Yes, a patch is available for CVE-2026-8564. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-8564

EUVD-2026-30377 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-05-14 Chrome

GHSA-xjfj-rmm4-g627

Information Disclosure Google

4.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L

vuln.today AI

3.1 LOW

Network-delivered UI spoofing requiring user interaction and high-complexity conditions; no direct integrity or availability impact from misrepresented download indicators.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.4 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:18 vuln.today

CVSS changed

May 14, 2026 - 22:22 NVD

4.2 (MEDIUM)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

MEDIUM 4.2

DescriptionCVE.org

Incorrect security UI in Downloads in Google Chrome on Android and Mac prior to 148.0.7778.168 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome's Downloads component on Android and macOS allows a remote, unauthenticated attacker to deceive users about the origin or safety of downloaded files by serving a crafted HTML page. All Chrome versions prior to 148.0.7778.168 on these two platforms are affected; Windows and Linux builds are not listed. No active exploitation has been identified - CISA KEV has no entry for this CVE, EPSS sits at 0.06% (18th percentile), and SSVC rates exploitation as none - placing this firmly in a low-urgency category despite the broad deployment footprint of the browser.

Technical ContextAI

The root cause is CWE-451 (User Interface Misrepresentation of Critical Information), a class of vulnerability in which a UI element fails to accurately convey the security state or origin of data to the user. Chrome's Downloads panel renders visual trust cues - file source, safety checks, download state - that a crafted HTML page can manipulate to misrepresent these signals on Android and macOS. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome versions without platform qualification, but the CVE description explicitly restricts the affected platforms to Android and Mac, implying platform-specific rendering or UI logic differs from the Windows/Linux builds. The Chromium issue tracker entry is likely restricted (https://issues.chromium.org/issues/418273622), so the precise DOM or renderer code path involved is not publicly confirmed.

RemediationAI

Vendor-released patch: Chrome 148.0.7778.168. Upgrade Google Chrome to version 148.0.7778.168 or later on all managed Android and macOS endpoints. Chrome typically applies updates automatically; administrators managing enterprise fleets should confirm the update has propagated via chrome://settings/help or equivalent MDM/policy reporting. The stable channel advisory detailing the fix is at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. No configuration change within Chrome eliminates the Downloads UI misrepresentation without the patch. As an interim measure prior to patching, user awareness training to verify download origins through independent channels (e.g., confirming file hashes, checking the actual URL in the address bar before initiating downloads) can reduce social engineering success rates, though this carries no technical enforcement and should not be treated as a substitute for the update.