Skip to main content

Chrome EUVDEUVD-2026-20709

| CVE-2026-5891 MEDIUM
User Interface (UI) Misrepresentation of Critical Information (CWE-451)
2026-04-08 Chrome
Information Disclosure Google Red Hat Suse Chrome
4.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
4.3 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
SUSE
MEDIUM
qualitative
Red Hat
4.1 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

5
Analysis Generated
Apr 15, 2026 - 12:45 vuln.today
CVSS changed
Apr 13, 2026 - 21:22 NVD
4.3 (MEDIUM)
Patch released
Apr 08, 2026 - 23:32 nvd
Patch available
EUVD ID Assigned
Apr 08, 2026 - 22:01 euvd
EUVD-2026-20709
CVE Published
Apr 08, 2026 - 21:20 nvd
N/A

DescriptionCVE.org

Insufficient policy enforcement in browser UI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome prior to version 147.0.7727.55 allows remote attackers with a compromised renderer process to deceive users through crafted HTML pages. The vulnerability requires prior renderer compromise, limiting real-world exploitation to scenarios where an attacker has already achieved code execution within the browser's sandboxed rendering context. No active exploitation confirmed; EPSS score of 0.03% indicates minimal exploitation probability.

Technical ContextAI

Chrome's renderer process operates in a sandbox that restricts access to sensitive browser UI elements and system resources. CWE-451 (User Interface (UI) Misrepresentation of Critical Information) describes the root cause: insufficient enforcement of policy boundaries that prevent renderer-process code from manipulating or spoofing browser UI elements. An attacker who has already compromised the renderer through another vulnerability (such as a memory corruption flaw) can leverage this policy gap to render deceptive UI overlays or false interface elements that misrepresent critical security indicators, such as address bar content, HTTPS indicators, or certificate warnings.

RemediationAI

Update Google Chrome to version 147.0.7727.55 or later immediately. The vendor-released patch is available through Chrome's auto-update mechanism or manual download from google.com/chrome. Users can verify their current version via Chrome Menu > Help > About Google Chrome, which will automatically download and install the latest version if not current. No workarounds mitigate the vulnerability short of disabling JavaScript or avoiding untrusted websites; patching is the only reliable remediation. For enterprise deployments, administrators should use Chrome OS management console or Windows/Mac group policies to enforce rapid rollout of version 147.0.7727.55 or newer. Reference: https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html

More in Chrome

View all
CVE-2015-5122 CRITICAL POC
9.8 Jul 14

Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
CVE-2016-5198 HIGH POC
8.8 Jan 19

V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac

CVE-2017-5070 HIGH POC
8.8 Oct 27

Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
CVE-2016-1646 HIGH POC
8.8 Mar 29

The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
CVE-2013-0758 CRITICAL POC
9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
CVE-2017-5030 HIGH POC
8.8 Apr 24

Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
CVE-2012-3993 CRITICAL POC
9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
CVE-2017-3823 HIGH POC
8.8 Feb 01

An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
CVE-2014-8636 HIGH POC
7.5 Jan 14

The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with

CVE-2013-0757 CRITICAL POC
9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
CVE-2014-1510 CRITICAL POC
9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
CVE-2015-5123 CRITICAL
9.8 Jul 14

Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13

Same weakness CWE-451 – User Interface (UI) Misrepresentation of Critical Information

View all
CVE-2025-8043 CRITICAL POC
9.8
CVE-2024-55889 HIGH POC
7.2
CVE-2025-7021 MEDIUM POC
6.5
CVE-2022-2800 MEDIUM POC
6.1
CVE-2026-0907 CRITICAL
9.8
CVE-2026-0906 CRITICAL
9.8
CVE-2026-2634 CRITICAL
9.8
CVE-2016-9467 MEDIUM POC
5.3

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Package Hub 15 SP6 Fixed
openSUSE Leap 15.6 Fixed
openSUSE Tumbleweed Fixed
SUSE Package Hub 15 SP6 Fixed

Share

EUVD-2026-20709 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy