EUVD-2026-28115Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
UI:R is mandatory (extension install required); spoofing affects perceived integrity (I:L) and limited confidentiality (C:L); no availability impact evident from description.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)
AnalysisAI
UI spoofing in Google Chrome's DevTools prior to version 148.0.7778.96 enables a crafted extension to misrepresent critical interface information to users, exploitable only after an attacker convinces a target to install the malicious extension. Exploitation requires meaningful social engineering effort and no public exploit code or active exploitation has been identified at time of analysis - SSVC rates exploitation as none and EPSS places this at only the 3rd percentile. The Chrome security team rated this Low severity internally, consistent with the multi-step prerequisite chain and limited post-exploitation impact.
Technical ContextAI
The root cause is CWE-451 (User Interface Misrepresentation of Critical Information), meaning Chrome's DevTools layer fails to enforce extension policy boundaries strictly enough to prevent crafted extensions from manipulating what the user visually perceives in the UI. Chrome Extensions operate within a privileged JavaScript environment with access to Chrome APIs; when DevTools policy is insufficiently enforced, an extension can inject or overlay deceptive UI elements into DevTools panels or the broader browser chrome. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms all platform variants of the Chrome browser are within scope. This class of vulnerability is particularly relevant to developer-facing tooling, where users may be more likely to interact with third-party extensions and less suspicious of DevTools-level UI anomalies.
RemediationAI
Update Google Chrome to version 148.0.7778.96 or later, the vendor-released patch confirmed via the Chrome Stable Channel update advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will deliver this in most enterprise and consumer deployments; administrators managing fleet deployments via Group Policy or MDM should push the update and verify version compliance. As a compensating control where immediate patching is not possible, organizations can restrict extension installation to an approved allowlist via Chrome Enterprise ExtensionInstallAllowlist policy, which eliminates the malicious extension installation prerequisite entirely. Disabling or restricting access to Chrome DevTools via DevToolsAvailability policy is a second compensating control that removes the exploitable surface, though this will impact developer workflows. Both compensating controls carry operational trade-offs and are not substitutes for patching.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today