EUVD-2026-30384
GHSA-hcjh-qfp6-29c4
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:L
Extension distribution is network-delivered but AC:H for social engineering; scope changes to trusted Chrome UI; no direct availability impact from UI spoofing alone.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Downloads in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Medium)
AnalysisAI
UI spoofing in Google Chrome's Downloads component on macOS (versions prior to 148.0.7778.168) enables an attacker to misrepresent critical download-related interface elements to users who have been socially engineered into installing a malicious Chrome extension. The flaw stems from an inappropriate implementation (CWE-451) in how the Downloads feature handles extension-controlled rendering within trusted Chrome UI context, permitting a crafted extension to manipulate what users perceive about file origins or download safety prompts. No public exploit code is identified, EPSS is at 0.01% (3rd percentile), and CISA SSVC classifies exploitation status as none - indicating this is a real but low-operational-priority issue.
Technical ContextAI
CWE-451 (User Interface Misrepresentation of Critical Information) describes failures where security-critical UI elements can be manipulated to deceive users. In Chrome's extension architecture, extensions have privileged access to browser internals via the Chrome Extension API, including hooks into download events and UI overlays. The inappropriate implementation in the Downloads subsystem on macOS allows a crafted extension to interfere with how download-related prompts or status indicators are rendered, blurring the boundary between extension-controlled and browser-trusted UI. The CVSS Scope:Changed metric confirms the exploit escapes the extension's own context and affects the broader Chrome trusted UI. Affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all versions prior to 148.0.7778.168, and the flaw is Mac-platform-specific per the CVE description.
RemediationAI
Update Google Chrome on macOS to version 148.0.7778.168 or later, which is confirmed as the patched release per the vendor's Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. Chrome's built-in updater (Settings → About Chrome) is the recommended update path. As an immediate compensating control that directly neutralizes the sole attack prerequisite, organizations managing fleets via enterprise policy should enforce the ExtensionInstallAllowlist or ExtensionInstallBlocklist Chrome policies to prevent installation of unvetted extensions - this eliminates the attack vector entirely at the cost of restricting user extension autonomy. Individual users should audit installed extensions and remove any from unknown or unverified publishers. Linux-based environments using Red Hat or SUSE packaged Chromium should apply the relevant distribution security errata when available.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today