Monthly
UI misrepresentation in Google Chrome's Web Authentication (WebAuthn) subsystem - covering both Passkeys and hardware Security Keys - prior to version 152.0.7977.65 allows remote attackers to manipulate authentication dialog presentation via a crafted HTML page, enabling bypass of system access restrictions through social engineering. The CVSS vector rates Integrity impact as High (I:H) with no privileges required (PR:N), yet Chromium's own team assigned Low severity, and EPSS exploitation probability is just 0.22% (12th percentile), reflecting the social engineering dependency. No public exploit has been identified and no CISA KEV listing exists at time of analysis.
UI spoofing in Google Chrome prior to 152.0.7977.65 allows unauthenticated remote attackers to misrepresent browser interface elements through a crafted HTML page, requiring only that a user visit the malicious content. Classified as CWE-451 (UI Misrepresentation of Critical Information), the flaw breaks the trust contract between the browser and user by rendering deceptive interface states - a classic phishing-enabler primitive. No public exploit code has been identified and EPSS stands at 0.22% (12th percentile), consistent with Chromium's own Low severity rating; real-world exploitation impact is constrained by its dependence on social engineering and user interaction.
UI spoofing in Google Chrome on macOS prior to 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to forge browser UI elements via a crafted HTML page, potentially deceiving users into believing they are interacting with a trusted interface. The vulnerability is macOS-specific and requires renderer process compromise as an explicit prerequisite, significantly limiting its standalone exploitability. No public exploit code or active exploitation (CISA KEV) has been identified; an EPSS score of 0.21% (11th percentile) reflects negligible likelihood of independent exploitation.
Address bar spoofing in Google Chrome for Android's CustomTabs feature enables remote unauthenticated attackers to misrepresent the displayed URL to users through a crafted HTML page. All Chrome for Android versions prior to 152.0.7977.65 are affected on the Android platform only; desktop Chrome is not impacted. No public exploit identified at time of analysis, and the EPSS score of 0.17% (7th percentile) combined with Chromium's own 'Low' severity rating reflect limited real-world exploitation probability, though the phishing-enablement potential makes it worth patching promptly.
UI spoofing in Google Chrome's Transactions Platform prior to version 152.0.7977.65 enables remote attackers to misrepresent UI elements - such as payment confirmation dialogs or security indicators - through a crafted HTML page, relying on social engineering for delivery. Classified under CWE-451 (UI Misrepresentation of Critical Information), the flaw requires user interaction and carries no confidentiality or availability impact, confining harm to integrity via deception. No active exploitation is confirmed and EPSS probability is very low (0.29%), but the ubiquitous deployment footprint of Chrome means the absolute population of potential targets is large.
Chrome's PermissionElement component can be visually spoofed via a crafted HTML page, allowing a remote attacker to mislead users into granting browser permissions they did not intend to approve. All Chrome desktop versions prior to 152.0.7977.65 are affected, as confirmed by the vendor's Stable Channel advisory and EUVD-2026-66037. No public exploit code has been identified at time of analysis, and EPSS at 0.17% reflects negligible observed exploitation interest.
UI misrepresentation in Linux Toolkit Theming in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
UI misrepresentation in Google Chrome's Geometry rendering component allows remote attackers to spoof browser interface elements by delivering a crafted HTML page to an unaware user. Versions prior to 152.0.7977.65 are affected across all desktop platforms where Chrome is installed. With CVSS 5.4, a low EPSS of 0.17% (7th percentile), and no CISA KEV listing, this is a moderate-severity phishing and social-engineering amplifier rather than a code-execution vector - but Chrome's near-ubiquitous deployment means the aggregate exposure is broad.
CustomTabs UI spoofing in Google Chrome for Android (prior to 152.0.7977.65) allows a remote attacker using social engineering to misrepresent browser UI elements through a crafted HTML page, enabling phishing-grade deception of users who believe they are interacting with a trusted interface. The flaw is classified under CWE-451 (UI Misrepresentation of Critical Information) and is limited to the Android platform's CustomTabs feature. No active exploitation is confirmed via CISA KEV, and EPSS sits at 0.22% (13th percentile), indicating negligible current exploitation activity.
UI misrepresentation in Chrome's WebAppInstalls component allows remote attackers to spoof browser UI elements by serving a crafted HTML page to a user who visits it. All Chrome releases prior to 152.0.7977.65 are affected across desktop platforms. Exploitation requires user interaction (visiting a malicious page) but no authentication, and could be used to deceive users into believing they are interacting with a trusted installation prompt - for example, tricking a user into approving a Progressive Web App install from an attacker-controlled origin. No public exploit code has been identified and EPSS is low (0.22%, 13th percentile), placing this firmly in the 'patch on schedule' tier rather than emergency response.
UI misrepresentation in Google Chrome's Web Authentication (WebAuthn) subsystem - covering both Passkeys and hardware Security Keys - prior to version 152.0.7977.65 allows remote attackers to manipulate authentication dialog presentation via a crafted HTML page, enabling bypass of system access restrictions through social engineering. The CVSS vector rates Integrity impact as High (I:H) with no privileges required (PR:N), yet Chromium's own team assigned Low severity, and EPSS exploitation probability is just 0.22% (12th percentile), reflecting the social engineering dependency. No public exploit has been identified and no CISA KEV listing exists at time of analysis.
UI spoofing in Google Chrome prior to 152.0.7977.65 allows unauthenticated remote attackers to misrepresent browser interface elements through a crafted HTML page, requiring only that a user visit the malicious content. Classified as CWE-451 (UI Misrepresentation of Critical Information), the flaw breaks the trust contract between the browser and user by rendering deceptive interface states - a classic phishing-enabler primitive. No public exploit code has been identified and EPSS stands at 0.22% (12th percentile), consistent with Chromium's own Low severity rating; real-world exploitation impact is constrained by its dependence on social engineering and user interaction.
UI spoofing in Google Chrome on macOS prior to 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to forge browser UI elements via a crafted HTML page, potentially deceiving users into believing they are interacting with a trusted interface. The vulnerability is macOS-specific and requires renderer process compromise as an explicit prerequisite, significantly limiting its standalone exploitability. No public exploit code or active exploitation (CISA KEV) has been identified; an EPSS score of 0.21% (11th percentile) reflects negligible likelihood of independent exploitation.
Address bar spoofing in Google Chrome for Android's CustomTabs feature enables remote unauthenticated attackers to misrepresent the displayed URL to users through a crafted HTML page. All Chrome for Android versions prior to 152.0.7977.65 are affected on the Android platform only; desktop Chrome is not impacted. No public exploit identified at time of analysis, and the EPSS score of 0.17% (7th percentile) combined with Chromium's own 'Low' severity rating reflect limited real-world exploitation probability, though the phishing-enablement potential makes it worth patching promptly.
UI spoofing in Google Chrome's Transactions Platform prior to version 152.0.7977.65 enables remote attackers to misrepresent UI elements - such as payment confirmation dialogs or security indicators - through a crafted HTML page, relying on social engineering for delivery. Classified under CWE-451 (UI Misrepresentation of Critical Information), the flaw requires user interaction and carries no confidentiality or availability impact, confining harm to integrity via deception. No active exploitation is confirmed and EPSS probability is very low (0.29%), but the ubiquitous deployment footprint of Chrome means the absolute population of potential targets is large.
Chrome's PermissionElement component can be visually spoofed via a crafted HTML page, allowing a remote attacker to mislead users into granting browser permissions they did not intend to approve. All Chrome desktop versions prior to 152.0.7977.65 are affected, as confirmed by the vendor's Stable Channel advisory and EUVD-2026-66037. No public exploit code has been identified at time of analysis, and EPSS at 0.17% reflects negligible observed exploitation interest.
UI misrepresentation in Linux Toolkit Theming in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
UI misrepresentation in Google Chrome's Geometry rendering component allows remote attackers to spoof browser interface elements by delivering a crafted HTML page to an unaware user. Versions prior to 152.0.7977.65 are affected across all desktop platforms where Chrome is installed. With CVSS 5.4, a low EPSS of 0.17% (7th percentile), and no CISA KEV listing, this is a moderate-severity phishing and social-engineering amplifier rather than a code-execution vector - but Chrome's near-ubiquitous deployment means the aggregate exposure is broad.
CustomTabs UI spoofing in Google Chrome for Android (prior to 152.0.7977.65) allows a remote attacker using social engineering to misrepresent browser UI elements through a crafted HTML page, enabling phishing-grade deception of users who believe they are interacting with a trusted interface. The flaw is classified under CWE-451 (UI Misrepresentation of Critical Information) and is limited to the Android platform's CustomTabs feature. No active exploitation is confirmed via CISA KEV, and EPSS sits at 0.22% (13th percentile), indicating negligible current exploitation activity.
UI misrepresentation in Chrome's WebAppInstalls component allows remote attackers to spoof browser UI elements by serving a crafted HTML page to a user who visits it. All Chrome releases prior to 152.0.7977.65 are affected across desktop platforms. Exploitation requires user interaction (visiting a malicious page) but no authentication, and could be used to deceive users into believing they are interacting with a trusted installation prompt - for example, tricking a user into approving a Progressive Web App install from an attacker-controlled origin. No public exploit code has been identified and EPSS is low (0.22%, 13th percentile), placing this firmly in the 'patch on schedule' tier rather than emergency response.