EUVD-2026-40714
GHSA-765q-5gmw-6rp7
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
Network-delivered via crafted page with no privileges required; high complexity due to mandatory UI gesture; UI spoofing yields no confidentiality or availability impact, only low integrity.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Incorrect security UI in SplitView in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
UI spoofing via incorrect security rendering in Chrome's SplitView component allows a remote attacker to misrepresent security-critical UI elements to a victim running any Chrome version prior to 150.0.7871.47. The attacker must serve a crafted HTML page and successfully induce the victim into performing specific UI gestures, after which SplitView renders misleading security indicators - enabling phishing-class deception within a trusted browser context. No public exploit code exists and no active exploitation has been confirmed; the Chromium team itself rated this Low severity, consistent with the CVSS 4.2 score and high attack complexity.
Technical ContextAI
CWE-451 (User Interface Misrepresentation of Critical Information) describes flaws where security-relevant UI elements are rendered incorrectly, allowing attackers to obscure or spoof what the user perceives as trustworthy. Chrome's SplitView feature - which renders multiple web content panes side by side - incorrectly handles its security UI in certain states, meaning that origin indicators, lock icons, or permission prompts may be drawn in a way that misrepresents the active page's true identity or security posture. Browsers are particularly sensitive to CWE-451 because the security UI (address bar, permission dialogs, HTTPS indicators) constitutes the primary trust boundary between the user and the web. The affected product is Google Chrome desktop versions prior to 150.0.7871.47, as confirmed by EUVD-2026-40714 and Google's stable channel release notes.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later, per the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome auto-updates by default on most desktop platforms, so users running standard consumer installs will typically receive this fix without manual action; enterprise administrators should validate that managed Chrome deployments are current via endpoint management tooling (Google Admin, Intune, or similar). As a targeted workaround pending update propagation, disabling or avoiding use of Chrome's SplitView feature removes the specific attack surface for this vulnerability with no significant operational trade-off for most users. No additional compensating controls are required for organizations maintaining current update cadences.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today