What is the CVSS score of CVE-2026-9110?

CVE-2026-9110 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-9110?

Yes, a patch is available for CVE-2026-9110. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-9110

EUVD-2026-31159 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-05-20 Chrome

GHSA-rgw2-264p-h9j3

Information Disclosure Google Microsoft

4.2

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L

SUSE

MEDIUM

qualitative

Red Hat

2.8 LOW

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 22:35 vuln.today

CVSS changed

May 20, 2026 - 20:22 NVD

4.2 (MEDIUM)

Patch available

May 20, 2026 - 20:02 EUVD

CVE Published

May 20, 2026 - 19:12 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in UI in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

UI spoofing in Google Chrome on Windows (prior to 148.0.7778.179) enables a remote attacker who has already achieved renderer process compromise to deceive end users through a crafted HTML page, exploiting CWE-451 (UI Misrepresentation of Critical Information). Affected users on Windows running any Chrome version below 148.0.7778.179 are exposed to potential phishing or credential-harvesting scenarios dressed up as legitimate browser UI. No public exploit code or CISA KEV listing exists at time of analysis, but the Chromium team assigned a Critical internal severity - a meaningful contrast with the NVD CVSS score of 4.2 - suggesting the spoofing potential carries downstream risk beyond what the base score reflects.

Technical ContextAI

The vulnerability is rooted in CWE-451 (User Interface Misrepresentation of Critical Information), meaning the Chrome UI layer on Windows fails to correctly enforce trust boundaries between renderer-controlled content and the trusted browser chrome (address bar, security indicators, dialogs). Affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all versions prior to 148.0.7778.179 on Windows. The renderer process in Chromium is a sandboxed component that handles untrusted web content; under normal circumstances it cannot influence trusted UI elements. This vulnerability represents an inappropriate implementation that breaks that isolation specifically on Windows, allowing renderer-controlled HTML to manipulate or mimic browser-native UI surfaces. The Windows-specificity suggests a platform-dependent code path in Chrome's UI rendering or inter-process communication layer.

RemediationAI

Update Google Chrome on Windows to version 148.0.7778.179 or later - this is the vendor-confirmed patched release per the Chrome stable channel advisory (http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html). Chrome's automatic update mechanism should deliver this without manual intervention for most enterprise and consumer deployments, but administrators managing fleet deployments via policy should verify version compliance. No workarounds are documented by the vendor for this issue. Since exploitation requires prior renderer compromise, organizations that enforce Chrome's built-in sandbox hardening, Site Isolation, and process-level security policies reduce the likelihood of satisfying the prerequisite attack condition - though these are not substitutes for patching. The 'Microsoft' tag in the intelligence data appears to be a metadata artifact and does not imply a Microsoft-issued patch or advisory is required.