EUVD-2026-28109Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
UI spoofing carries integrity impact (I:L) by definition; no availability impact applies, correcting the vendor vector's A:L.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Insufficient validation of untrusted input in TabGroups in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform UI spoofing via malicious network traffic. (Chromium security severity: Low)
AnalysisAI
UI spoofing via malicious network traffic is possible in Google Chrome's TabGroups component in all versions prior to 148.0.7778.96, exploitable by unauthenticated remote attackers who can induce user interaction. The root cause is insufficient input validation (CWE-20) in the TabGroups feature, allowing crafted network traffic to manipulate browser UI elements and deceive users about page origin or content. No public exploit exists and EPSS sits at 0.05% (17th percentile), consistent with SSVC's 'exploitation: none' and the vendor's own 'Low' Chromium severity rating - real-world risk is low despite the broad attack surface of a ubiquitous browser.
Technical ContextAI
The affected component is Google Chrome's TabGroups feature - the browser subsystem responsible for grouping and rendering tab collections in the UI. The root cause class is CWE-20 (Improper Input Validation): data arriving via network traffic is not adequately sanitized before being processed or rendered within the TabGroups UI context. This allows an attacker-controlled network response to influence visual elements of the browser chrome, a classic UI redress/spoofing surface. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome application builds across platforms (Windows, macOS, Linux, and likely ChromeOS) for versions below the fixed release 148.0.7778.96, as confirmed by the EUVD affected-version range. Distribution coverage by Red Hat and SUSE tags suggests downstream Linux packaging carries the same exposure.
RemediationAI
The primary remediation is upgrading Google Chrome to version 148.0.7778.96 or later, as released in the stable channel update documented at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will apply this for most desktop users without manual intervention; administrators managing enterprise deployments should verify rollout via Chrome Browser Cloud Management or group policy. For Linux environments managed by Red Hat or SUSE, apply the updated Chrome package through the standard distribution package manager once downstream packages are published. No specific workaround for the TabGroups input validation flaw is documented; organizations with high-risk user populations (e.g., executives, finance teams) may temporarily disable TabGroups via enterprise policy (TabGroupsEnabled=false) as a compensating control, though this removes productivity functionality. No patch version other than 148.0.7778.96 is independently confirmed.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today