EUVD-2026-50761
GHSA-qgxw-xv94-599v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious HTML abusing DigitalCredentials API
-
DeliveryDeliver link to victim via phishing or malvertising
-
ExploitVictim navigates to page in unpatched Chrome
-
ExecutionSpoofed credential dialog rendered in browser UI
-
PersistVictim submits identity credentials believing request is legitimate
-
ImpactAttacker captures disclosed credential data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security UI security representation
|
| Exploitation Conditions | The victim must navigate to a crafted HTML page under attacker control, making user interaction (UI:R per CVSS) a hard prerequisite - drive-by exploitation without any user action is not possible. The vulnerability is exercised through the DigitalCredentials web API, meaning the browser context must support this API (available in Chrome prior to 151.0.7922.72). No authentication or special browser configuration is required on the attacker side. What limits exploitation: user interaction cannot be bypassed; users must be socially engineered into visiting the attacker's page; the impact is confined to UI deception rather than code execution or persistent access; and the feature is relatively new and niche, meaning users are unlikely to encounter unsolicited DigitalCredentials dialogs in everyday browsing - which may reduce the effectiveness of spoofing attacks for victims unfamiliar with the legitimate UI. |
| Impact | The NVD CVSS 3.1 score of 5.4 (Medium) is consistent with a UI-based spoofing issue: network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), but requiring user interaction (UI:R), with unchanged scope (S:U) and limited confidentiality and availability impacts. The EPSS score of 0.17% at the 7th percentile is a strong signal that this vulnerability has not attracted significant attacker interest or tooling. There is no CISA KEV listing and no indication of a public proof-of-concept. The tags indicate 'Information Disclosure,' which aligns with the spoofing vector - users could be tricked into believing a fraudulent credential request is legitimate, potentially disclosing sensitive identity information. The A:L impact in the original CVSS vector is difficult to reconcile with a pure UI spoofing primitive, which typically does not cause service disruption; this represents a possible upstream scoring inconsistency. Overall, this is a genuine but low-priority vulnerability: the attack surface is broad (all Chrome users), but exploitation requires social engineering, has no known weaponized code, and the spoofing outcome is indirect rather than providing direct code execution or data exfiltration. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page that abuses the DigitalCredentials API to render a spoofed browser-native credential request dialog, making it appear as though a trusted identity provider or government service is requesting credential presentation. A victim browsing to the page - potentially via phishing link or malvertising - interacts with the spoofed dialog and submits sensitive identity details believing the request to be legitimate. No public proof-of-concept code has been identified at time of analysis, and successful exploitation requires luring the victim to the attacker-controlled page. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
UI spoofing via the DigitalCredentials API in Google Chrome prior to 151.0.7922.72 allows a remote, unauthenticated attacker to deceive users about the legitimacy or origin of credential-related dialogs through a crafted HTML page. The vulnerability stems from an inappropriate implementation in Chrome's handling of the DigitalCredentials web API (CWE-451), enabling misrepresentation of critical UI information. No active exploitation is confirmed (no CISA KEV listing), and with an EPSS score of 0.17% at the 7th percentile, real-world exploitation probability is currently very low.
RemediationAI
The primary remediation is updating Google Chrome to version 151.0.7922.72 or later, as confirmed by the Chrome Stable Channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's built-in auto-update mechanism should deliver this patch automatically on most endpoints; administrators managing enterprise deployments should verify rollout via Google Admin Console or group policy. If immediate upgrade is not feasible, restricting or disabling use of the DigitalCredentials API via enterprise policy (if a Chrome policy exists for this feature) would reduce exposure - however, this may break legitimate digital identity workflows. Blocking access to untrusted external web content via proxy or content filtering can reduce the attack surface since exploitation requires user navigation to a crafted HTML page. No workaround fully substitutes for patching, and none of these compensating controls carry confirmed effectiveness against all exploit variants.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The DigitalCredentials API is a browser-level web platform API designed to facilitate the presentation and verification of digital identity credentials - such as digital driver's licenses or government IDs - within web contexts. CWE-451 (User Interface Misrepresentation of Critical Information) describes vulnerabilities where the UI fails to accurately represent security-sensitive information to users, enabling attacker-crafted content to masquerade as legitimate browser or credential-provider UI. An inappropriate implementation in this API within Chromium-based Google Chrome means the browser does not correctly enforce UI boundaries or origin indicators when rendering credential dialogs, allowing crafted HTML to inject or spoof those elements. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome versions prior to 151.0.7922.72 on all platforms.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Network delivery via crafted HTML with no privileges needed; UI:R required; A:N because UI spoofing does not cause service disruption, contradicting the upstream A:L metric.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in DigitalCredentials in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB