EUVD-2026-40837
GHSA-jgqx-24xr-rw55
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
AC:H reflects the mandatory renderer-process compromise prerequisite; UI:R for required user page visit; C:L/I:L captures limited spoofing impact with no availability effect.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Insufficient validation of untrusted input in Speech in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
UI spoofing via the Speech component in Google Chrome prior to 150.0.7871.47 requires an attacker to have already compromised the renderer process, making this a chained, second-stage exploit rather than a standalone remote attack. The vulnerability stems from insufficient input validation (CWE-20) in Chrome's Speech subsystem, enabling a renderer-compromised attacker to manipulate browser UI elements through a crafted HTML page. No public exploit code exists, SSVC assessment confirms no active exploitation, and an EPSS score of 0.17% (7th percentile) reflects a very low probability of mass exploitation - consistent with Google's own 'Low' internal severity rating.
Technical ContextAI
The vulnerability resides in the Speech component of Google Chrome's multi-process rendering architecture, confirmed by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*. CWE-20 (Improper Input Validation) identifies the root cause: the Speech subsystem fails to adequately validate untrusted input received from renderer-side content. In Chrome's sandbox model, the renderer process is isolated and handles HTML/JS parsing; however, a compromised renderer can interact with browser-level subsystems such as Speech in ways that expose secondary attack surfaces. The insufficient validation path allows the compromised renderer to inject or manipulate browser UI elements - such as address bar content, permission prompts, or dialog boxes - presenting false context to the user despite the sandboxed renderer being the source.
RemediationAI
Upgrade Google Chrome to version 150.0.7871.47 or later, which resolves this vulnerability per the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism delivers this patch automatically for most consumer deployments; enterprise administrators should verify rollout completion via Chrome Browser Cloud Management or Group Policy (GoogleUpdatePolicies). Given the low severity and chained exploitation requirement, no emergency out-of-band action is warranted. For organizations operating in high-risk targeted environments already concerned about renderer exploitation chains, disabling the Web Speech API via the Chrome enterprise policy DisabledFeatures list provides a compensating control, with the trade-off of breaking any internal or third-party web applications that rely on speech recognition or synthesis functionality.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today