EUVD-2026-40673
GHSA-4gpx-jrqf-pgvg
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
AC:H reflects the required prior renderer compromise; AV:N retained as the crafted page is network-delivered; I:H for UI integrity spoofing with no confidentiality or availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Inappropriate implementation in MediaCapture in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
UI spoofing via MediaCapture in Google Chrome prior to 150.0.7871.47 enables a remote attacker who has already compromised the renderer process to misrepresent browser UI through a crafted HTML page, potentially deceiving users into granting permissions or trusting malicious content. This is a chained exploitation technique - it requires a prior renderer compromise as a prerequisite - making it a post-exploitation integrity threat rather than an initial access vector. EPSS is 0.21% (11th percentile), no public exploit or CISA KEV listing exists at time of analysis, and Google has patched this in the stable channel update.
Technical ContextAI
MediaCapture is the browser subsystem implementing the W3C Media Capture and Streams API, which governs access to camera, microphone, and screen-sharing capabilities. CWE-451 (User Interface Misrepresentation of Critical Information) indicates the root cause: the MediaCapture implementation fails to correctly render security-sensitive UI indicators when the renderer process is in a compromised state, allowing the attacker-controlled renderer to forge or suppress UI elements that users rely on to make trust decisions (e.g., permission prompts, origin indicators, or capture status banners). The affected versions span all Chrome desktop releases prior to 150.0.7871.47. This class of flaw is particularly significant in Chrome's multi-process architecture because the renderer is considered an untrusted sandbox boundary - hence Google's threat model treats renderer-compromise as a valid attacker starting condition.
RemediationAI
Upgrade Google Chrome to version 150.0.7871.47 or later using Chrome's built-in update mechanism (chrome://settings/help) or via enterprise management tools (Google Admin Console, Intune). The patch is confirmed available per the vendor's stable channel advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Because exploitation of this vulnerability requires a prior renderer process compromise, organizations that cannot immediately patch should treat renderer-sandboxing integrity as the first line of defense: ensure Chrome's sandbox is not disabled (do not run Chrome with --no-sandbox), enforce site isolation policies (SitePerProcess), and restrict extension installations to vetted, enterprise-controlled extensions that could otherwise introduce renderer-level code execution. These compensating controls reduce the likelihood of a renderer compromise occurring in the first place, which is the prerequisite for this specific flaw to be exploitable.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today