EUVD-2026-40676
GHSA-r2vg-p5p5-74fm
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network-delivered via crafted page requiring no attacker privileges (PR:N), victim must visit URL (UI:R); integrity-only impact as UI spoofing deceives but does not leak data or crash.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
UI spoofing in Google Chrome's Paint rendering component (all desktop versions prior to 150.0.7871.47) allows a remote, unauthenticated attacker to misrepresent critical browser interface information by directing a victim to a crafted HTML page. The flaw, rooted in CWE-451 (UI Misrepresentation of Critical Information), enables manipulation of rendered content to deceive users about page origin, security indicators, or trusted UI chrome. EPSS is very low at 0.17% (7th percentile), SSVC confirms no current exploitation, and the vulnerability is absent from CISA KEV, making this a medium-priority patch-and-monitor item rather than an emergency despite the CVSS 6.5 rating.
Technical ContextAI
The vulnerability resides in the Paint subsystem of Google Chrome - the component responsible for compositing and rendering web content to the screen. CWE-451 (User Interface Misrepresentation of Critical Information) describes a class of flaw where the browser's rendering pipeline fails to correctly distinguish or visually isolate trusted UI elements from attacker-controlled content, allowing crafted HTML or CSS to overlay, obscure, or mimic browser chrome such as address bars, lock icons, or permission dialogs. This is a known attack surface in browser rendering engines: painting and compositing layers can sometimes be manipulated to produce visually convincing but deceptive outputs. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all desktop builds prior to version 150.0.7871.47. The SUSE tag in the intelligence data indicates that downstream Linux distribution packages of Chrome are also in scope and require independent update tracking.
RemediationAI
The primary fix is to upgrade Google Chrome to version 150.0.7871.47 or later, as released in Google's Stable Channel Update documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's built-in auto-update mechanism will deliver this to most consumer desktop users automatically; enterprise administrators should verify fleet compliance using Chrome Browser Cloud Management or a comparable endpoint management platform and enforce the minimum version policy accordingly. SUSE Linux administrators should monitor SUSE security channels for distribution-specific package updates, as upstream release timing may diverge from Google's direct builds. As a compensating control before patching, user awareness training to manually verify URL bar content and avoid clicking unsolicited links provides marginal risk reduction; however, because the flaw's effect is specifically to undermine visual trust indicators, this is not a reliable standalone mitigation and carries the trade-off of relying on user vigilance against a technically sophisticated visual deception. No configuration-level workaround is available that eliminates the vulnerability without upgrading.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today