EUVD-2026-40677
GHSA-q49j-767p-6v57
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack is network-delivered via crafted HTML (AV:N) but requires prior renderer compromise (AC:H); UI:R for page interaction; I:H for full security indicator spoofing; C and A are N.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Inappropriate implementation in PageInfo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
UI spoofing in Google Chrome's PageInfo component affects all desktop versions prior to 150.0.7871.47, enabling an attacker who has already compromised the renderer process to present deceptive browser security indicators to the user via a crafted HTML page. The vulnerability stems from an inappropriate implementation in the PageInfo subsystem (CWE-451), which controls the trusted security panel users consult to assess site authenticity. No active exploitation is confirmed - EPSS is 0.17% (7th percentile), SSVC rates exploitation as none, and this CVE is absent from the CISA KEV catalog - but the integrity impact is high where the attack chain is achievable.
Technical ContextAI
PageInfo is the Chrome browser component responsible for rendering the security information panel (the padlock/info icon popup) that communicates origin trust, certificate status, and permission grants to users. CWE-451 (User Interface Misrepresentation of Critical Information) identifies root cause as a failure to correctly represent security-critical data, allowing an attacker to inject or manipulate what the user perceives as authoritative browser UI. The affected codebase is the Chromium rendering engine, identified via CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* across all desktop platforms. Because PageInfo operates across the renderer/browser process boundary, a compromised renderer can supply malicious data that the browser process incorrectly renders as trustworthy UI - this is consistent with the AC:H CVSS metric reflecting the renderer compromise prerequisite.
RemediationAI
Upgrade Google Chrome to version 150.0.7871.47 or later - this is the vendor-released patch confirmed by the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome typically auto-updates, but enterprise environments managing Chrome via Group Policy or browser management platforms should push the update and verify version compliance. As a compensating control where immediate patching is not feasible, restricting access to high-risk browsing contexts (e.g., via allow-listing or browser isolation) can reduce exposure to the crafted HTML pages required to trigger the spoofing, though this does not address the underlying flaw. No side effects from the patch have been reported by the vendor.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today