EUVD-2026-27974Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in Speech in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
UI spoofing vulnerability in Google Chrome prior to 148.0.7778.96 allows remote attackers to deceive users through crafted HTML pages that manipulate the speech interface, potentially disclosing sensitive information or causing denial of service. The vulnerability requires user interaction (clicking or interacting with the malicious page) and affects the speech component's visual presentation. Chromium severity is rated Medium; no active exploitation has been publicly confirmed.
Technical ContextAI
The vulnerability exists in Chrome's Speech component (likely the Web Speech API or speech recognition UI) where inappropriate implementation of the speech interface handling fails to properly validate or sanitize HTML content, allowing attackers to spoof legitimate UI elements. CWE-451 (User Interface (UI) Misrepresentation of Critical Information) describes the root cause: the application fails to present critical information (such as speech input dialogs, permission prompts, or status indicators) in a way that cannot be confused with attacker-controlled content. This is facilitated by inadequate isolation between user-controlled HTML and the browser's native speech UI components. The CPE string (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) indicates all Chrome versions before the fix are theoretically affected, but the EUVD clarifies the actual vulnerable range is everything prior to version 148.0.7778.96.
RemediationAI
Vendor-released patch: Chrome 148.0.7778.96 and later. Users should immediately update Google Chrome to version 148.0.7778.96 or newer via Settings > About Chrome (automatic update) or manual download from https://www.google.com/chrome/. No workarounds are available for this vulnerability without disabling the speech feature entirely, which is not recommended. Enterprise administrators can enforce automatic updates via Chrome policies or push updates through device management solutions. The patch is confirmed available per Chrome security advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today