EUVD-2026-40829
GHSA-jgch-4h46-4q53
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Renderer-process compromise is an explicit prerequisite raising AC to H; UI spoofing yields only limited C/I impact with no availability or scope change.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Inappropriate implementation in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
UI spoofing in Google Chrome's Extensions implementation (all versions prior to 150.0.7871.47) enables a remote attacker - who has already achieved renderer process compromise via a separate exploit - to render deceptive UI elements through a crafted HTML page, potentially misleading users into unintended interactions. The vulnerability carries a CVSS 5.4 Medium score, though Chromium's internal rating is Low, and the EPSS score of 0.18% (8th percentile) reflects minimal exploitation probability. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Technical ContextAI
CWE-1021 (Improper Restriction of Rendered UI Layers or Frames) describes the root cause: Chrome's Extensions subsystem fails to properly constrain how UI layers are rendered, enabling an attacker-controlled renderer to overlay or substitute legitimate Chrome UI elements - such as permission prompts, security indicators, or dialog boxes - with attacker-crafted content. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all desktop Chrome builds prior to 150.0.7871.47. While the input tags this 'XSS,' CWE-1021 is more precisely a UI redressing or clickjacking-class flaw, not a cross-site scripting vector; the tag appears to be a misclassification. Chrome's multi-process architecture means the renderer runs in a sandboxed process, but an already-compromised renderer can still manipulate what users see within the browser UI surface exposed by the Extensions API.
RemediationAI
Vendor-released patch: Chrome 150.0.7871.47. Update Google Chrome to version 150.0.7871.47 or later via the browser's built-in update mechanism or enterprise deployment tooling, referencing the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Because exploitation requires a pre-existing renderer compromise, organizations that cannot immediately patch should treat any active browser exploitation chain as the higher-priority risk to remediate - blocking this secondary UI spoofing step provides limited standalone benefit without also closing renderer-level attack paths. Restricting untrusted extension installations via enterprise policy (ExtensionInstallBlocklist) reduces the Extensions attack surface in the interim, though this may impact user productivity and does not eliminate the underlying flaw.
Vendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today