EUVD-2026-40633
GHSA-87jv-prh3-pv4h
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Network delivery requires social engineering and crafted extension (AC:H, UI:R); UI spoofing yields only low integrity impact with no confidentiality or availability effects.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Insufficient policy enforcement in Extensions in Google Chrome on Linux prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Medium)
AnalysisAI
UI spoofing in Google Chrome on Linux (prior to 150.0.7871.47) allows a threat actor who socially engineers a victim into installing a crafted Chrome Extension to misrepresent browser UI elements, such as address bar content or security indicators, deceiving users about the legitimacy of web content. Exploitation requires both a Linux platform and successful social engineering to install the malicious extension, making mass automated attacks infeasible. No public exploit code exists, EPSS is 0.13% (3rd percentile), and CISA SSVC confirms exploitation status as none - consistent with the CVSS 3.1 Low score.
Technical ContextAI
The root cause is CWE-451 (User Interface Misrepresentation of Critical Information): Chrome's extension policy enforcement layer on Linux fails to adequately constrain the UI elements that a Chrome Extension can render or overlay within the browser chrome. Chrome Extensions operate under a sandboxed privilege model and interact with browser UI via extension APIs; when policy enforcement is insufficient, a crafted extension can paint misleading UI surfaces - fake address bars, spoofed security lock icons, or fraudulent permission dialogs - that misrepresent the true security state of the browser session to the user. Per CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, the affected product is Google Chrome across all sub-versions prior to 150.0.7871.47; however, the CVE description explicitly scopes the vulnerability to Linux, meaning Chrome on Windows and macOS are not identified as affected by this specific policy gap.
RemediationAI
Update Google Chrome on Linux to version 150.0.7871.47 or later, the vendor-released patch documented in the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Where immediate patching is not possible, the most effective compensating control is restricting extension installation via Chrome enterprise policy: configure ExtensionInstallBlocklist with a wildcard ('*') to block all extensions or use ExtensionInstallAllowlist to permit only vetted, administrator-approved extensions - this eliminates the primary exploitation prerequisite since the attack requires installing a malicious extension. Trade-off: blocking all extensions disrupts legitimate productivity tooling and requires an allowlist management process. Enabling Chrome's Enhanced Safe Browsing provides an additional signal for known-malicious extensions but does not protect against novel crafted extensions not yet flagged. Monitoring extension installation events via endpoint telemetry can provide detection coverage without blocking productivity.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today