EUVD-2026-40644
GHSA-8g45-73h2-9mgw
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
UI spoofing via PageInfo is network-delivered with specific gesture requirements (AC:H, UI:R); impact is limited to misleading security indicators (I:L) with no availability or confidentiality impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Incorrect security UI in PageInfo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
UI spoofing in Google Chrome's PageInfo component (all versions prior to 150.0.7871.47) enables remote attackers to misrepresent the browser's security indicators through a crafted HTML page that induces specific user UI gestures. The flaw (CWE-451) causes the PageInfo panel - the panel users consult to evaluate site trustworthiness - to render incorrect security UI, potentially deceiving victims into trusting malicious or unverified origins. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; exploitation requires high attack complexity and deliberate user interaction, keeping real-world risk moderate despite the ubiquitous deployment footprint of Chrome.
Technical ContextAI
The PageInfo component in Google Chrome is the security information panel surfaced when a user clicks the lock or info icon in the omnibar, displaying certificate details, cookie and permission state, and origin trust signals. CWE-451 (UI Misrepresentation of Critical Information) describes a class of flaws where the browser UI presents misleading security state, eroding the trust signals users rely on to make security decisions. In this case, a crafted HTML page can trigger incorrect rendering of PageInfo's security UI when the user performs specific gestures - likely sequences involving focus, scrolling, or element interaction that expose a rendering or state-management inconsistency in the PageInfo implementation. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L) confirms the flaw is network-delivered with no attacker-side authentication required, but contingent on high attack complexity and required user interaction. No CPE strings were provided in the intelligence data; affected platform scope is inferred as Chrome desktop (Windows, macOS, Linux) from the stable-channel advisory context. The Chromium issue tracker entry (issues.chromium.org/issues/513515168) may contain further technical detail.
RemediationAI
The primary fix is upgrading Google Chrome to version 150.0.7871.47 or later, which corrects the incorrect security UI in the PageInfo component; this is confirmed by the Chrome stable channel advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's built-in auto-update mechanism will deliver this patch automatically in most deployments; enterprise administrators should audit update policies (via Google Admin Console or GPO) to ensure update delivery is not blocked. As a compensating control prior to patching, security teams can advise users to validate site identity using the address bar URL directly rather than relying on the PageInfo panel, and to be suspicious of pages prompting unusual click sequences or UI interactions. Restricting access to untrusted external sites via proxy or DNS filtering reduces exposure to crafted pages but does not eliminate the vulnerability. No configuration-level workaround fully mitigates this flaw without the vendor-released patch.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today