EUVD-2026-40690
GHSA-77v7-hgwq-94jj
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
AC:H reflects the mandatory renderer-compromise prerequisite; all other metrics follow the provided vector, as UI:R and I:H are consistent with the spoofing impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Geolocation in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
UI spoofing in Google Chrome's Geolocation implementation allows an attacker who has already compromised the renderer process to present misleading geolocation-related interface elements to the user via a crafted HTML page. Affected versions are all Chrome releases prior to 150.0.7871.47. The integrity impact is rated High (CVSS I:H) because the spoofed UI can deceive users into granting or believing geolocation permissions under false pretenses; no public exploit or CISA KEV listing exists, and the 0.17% EPSS score (7th percentile) reflects low observed exploitation probability.
Technical ContextAI
The vulnerability resides in Chrome's Geolocation subsystem, which handles browser prompts and UI indicators related to location access requests. CWE-451 (User Interface Misrepresentation of Critical Information) identifies the root cause: the Geolocation implementation does not properly enforce the integrity of UI representations when the renderer process has been compromised, allowing that process to craft deceptive visual signals. Chrome's multi-process architecture relies on the browser process to mediate trusted UI; an inappropriate implementation in this boundary permits the renderer - normally sandboxed - to influence or fabricate geolocation-related UI elements that users rely on to make trust decisions. The affected CPE scope covers Chrome prior to version 150.0.7871.47 across all desktop platforms.
RemediationAI
Upgrade Google Chrome to version 150.0.7871.47 or later, which contains the vendor-released patch per the stable channel update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's automatic update mechanism will deliver this fix to most users without manual intervention; administrators managing enterprise deployments should push the update via Google Admin or GPO and verify the installed version against 150.0.7871.47. Because exploitation requires a prior renderer compromise, organizations should also ensure Chrome's built-in sandbox and site isolation features remain enabled - disabling these (e.g., via --no-sandbox flags) would lower the bar for the prerequisite renderer compromise. No workarounds are documented that isolate specifically the Geolocation spoofing surface; disabling Geolocation permissions site-wide via policy (ContentSetting BLOCK for geolocation) would eliminate the attack surface for this specific vector but would also break legitimate location-based web applications. The trade-off of that control is user experience degradation for sites relying on the Geolocation API.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today