EUVD-2026-34722
GHSA-phx2-2x4x-g268
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in PDF in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
UI spoofing in Google Chrome's PDF implementation prior to version 149.0.7827.53 can be triggered by a remote attacker who has already compromised the renderer process, using a crafted HTML page to mislead users through false interface elements. The vulnerability is rated Low severity by the Chromium security team, with a CVSS score of 4.3, and carries a negligible exploitation probability (EPSS 0.05%, 15th percentile). No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog, making real-world exploitation highly unlikely outside of sophisticated, chained attack scenarios.
Technical ContextAI
The flaw is rooted in CWE-20 (Improper Input Validation) within Chrome's PDF rendering component, where inappropriate implementation allows crafted HTML content to manipulate the browser's user interface presentation. The attack surface is Chrome's PDF subsystem, which processes PDF-embedded or PDF-adjacent HTML content inside the renderer process sandbox. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) indicates a network-delivered attack requiring user interaction, with only low integrity impact and no confidentiality or availability consequences. Crucially, the vulnerability description specifies that renderer process compromise is a prerequisite, placing this firmly in the category of a post-exploitation or chained exploit primitive rather than a standalone entry point. Affected versions are all Chrome releases prior to 149.0.7827.53 across desktop platforms.
RemediationAI
The primary remediation is to update Google Chrome to version 149.0.7827.53 or later, which is confirmed as the vendor-released patch per the stable channel update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will apply this fix automatically in most enterprise and consumer environments; administrators should verify update policies are not blocking delivery. Because exploitation requires a prior renderer process compromise as a precondition, organizations with Chrome running in strict site isolation mode (-site-per-process, which is the default in modern Chrome) already benefit from a significant structural defense that limits the blast radius of renderer compromises generally. No compensating control specifically addresses this UI spoofing flaw in lieu of patching, but restricting access to untrusted web content and PDF sources through proxy or DNS filtering reduces overall exposure to the renderer exploit chain that would need to precede this vulnerability.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today