EUVD-2026-40660
GHSA-535v-mq2p-6m4m
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Delivered via network over HTTP/HTTPS with no privilege required, but mandatory user navigation (UI:R); impact is limited to integrity via visual deception with no confidentiality or availability effect.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
UI spoofing in Google Chrome's Paint component prior to version 150.0.7871.47 allows a remote, unauthenticated attacker to misrepresent critical interface elements by delivering a crafted HTML page to a victim. The root cause is an inappropriate implementation in the Paint rendering subsystem (CWE-451), enabling visual deception that could facilitate phishing or credential theft. No public exploit code has been identified and CISA SSVC rates exploitation as none, placing real-world risk well below what the network-reachable attack vector might imply.
Technical ContextAI
The vulnerability originates in Chrome's Paint component - the subsystem responsible for compositing and rendering visual elements on screen. CWE-451 (User Interface Misrepresentation of Critical Information) describes flaws where an application renders interface elements in a misleading way, allowing an attacker to disguise the true origin, state, or content of UI components such as address bars, permission dialogs, or security indicators. The affected CPE scope is Google Chrome versions prior to 150.0.7871.47 across all supported desktop platforms. Because Paint operates deep in the Blink rendering pipeline, a crafted HTML page can trigger rendering behaviors that cause on-screen elements to appear differently than their actual DOM state, which attackers exploit to deceive users into acting on false information.
RemediationAI
The primary fix is to upgrade Google Chrome to version 150.0.7871.47 or later, which was released in the stable channel update documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism will deliver this patch to most endpoints without manual intervention; administrators should verify that managed deployments are not blocking automatic updates. No specific workaround is documented by the vendor. As a compensating control pending patch deployment, organizations can enforce URL-bar vigilance training and enable Enhanced Safe Browsing mode, which adds real-time phishing protections that partially reduce the social-engineering impact of UI spoofing; note this does not address the underlying rendering flaw.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today