EUVD-2026-40687
GHSA-r685-pmg3-7cqj
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network-delivered via extension distribution; no attacker privileges required; user must actively install extension (UI:R); spoofing causes limited integrity impact only with no confidentiality or availability consequence.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Insufficient validation of untrusted input in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Medium)
AnalysisAI
UI spoofing in Google Chrome's Extensions subsystem prior to version 150.0.7871.47 enables an attacker to manipulate browser interface elements through a specifically crafted malicious extension. The root cause is insufficient input validation (CWE-20) in Chrome's extension processing pipeline, allowing crafted extension code to forge UI elements and deceive users about browser state, visited origins, or security indicators. EPSS of 0.13% (3rd percentile) and SSVC exploitation status of 'none' confirm no active or automated exploitation at time of analysis; no public exploit code has been identified.
Technical ContextAI
The vulnerability resides in the Google Chrome Extensions subsystem (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*), specifically in how Chrome validates and sanitizes input originating from installed browser extension code. CWE-20 (Improper Input Validation) identifies the root cause class: Chrome fails to sufficiently constrain or reject malformed or malicious data supplied by extension APIs, enabling a crafted extension to influence rendered UI elements. Practical manifestations could include forged address bar URLs, fabricated security dialog boxes, spoofed permission prompts, or counterfeit browser chrome elements - all of which may cause a user to trust or act on a false representation of the browser's actual state. The Chromium issue tracker entry (issues.chromium.org/issues/514071697) references the internal bug, and the fix shipped in the desktop Stable Channel update documented at the Chrome Releases blog.
RemediationAI
Vendor-released patch: Chrome 150.0.7871.47. Users should update Google Chrome to version 150.0.7871.47 or later via the built-in update mechanism (Chrome menu → Help → About Google Chrome) or by downloading from the official Google Chrome release channel. The patch advisory is at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. For SUSE-based Linux distributions, apply the relevant SUSE security advisory update for Chromium once released. As a compensating control before patching, enterprise administrators can deploy the 'ExtensionInstallBlocklist' Chrome policy set to '*' to block all extension installs, or use 'ExtensionInstallAllowlist' to permit only vetted extensions - note this restricts legitimate extension use and may affect productivity workflows. Restricting Chrome Web Store access via network policy is a secondary but lower-efficacy control.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today