EUVD-2026-50932
GHSA-gg38-5xph-567f
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
AC:H reflects the renderer-compromise prerequisite required before this Lens flaw is reachable; all other metrics follow the NVD assessment.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in Google Lens in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
UI spoofing via Google Lens in Google Chrome prior to 151.0.7922.72 is achievable by a remote attacker who has already compromised the renderer process, using a crafted HTML page to misrepresent interface elements to the victim. The attack requires a chained exploitation scenario: renderer compromise as a prerequisite, followed by abuse of an inappropriate implementation in the Lens component (CWE-451) to manipulate what the user perceives in the browser UI. No active exploitation is confirmed - CISA KEV does not list this CVE, SSVC assessment shows exploitation status of none, and EPSS sits at 0.16% (6th percentile), indicating very low real-world exploitation probability at time of analysis.
Technical ContextAI
Google Lens is a visual search and image analysis feature integrated into the Chrome browser, accessible via right-click context menus and overlaid UI panels. CWE-451 (User Interface Misrepresentation of Critical Information) describes a class of flaws where the software renders UI elements in a misleading way - in this context, the Lens implementation inappropriately processes or renders content from a crafted HTML page, potentially allowing spoofed UI overlays, fake security dialogs, or misrepresentation of page identity. The affected product is identified via CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome versions prior to 151.0.7922.72 across platforms. The renderer process is Chrome's sandboxed process responsible for parsing and rendering web content; a prior compromise of this process is required to reach the Lens vulnerability.
RemediationAI
The vendor-released patch is Chrome 151.0.7922.72. Users and administrators should update Chrome to this version or later via the built-in update mechanism (Settings > Help > About Google Chrome) or via enterprise deployment tools. The advisory is available at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because exploitation of this vulnerability requires a prior renderer process compromise, organizations that cannot immediately patch should prioritize mitigations against renderer exploitation more broadly - such as enabling Chrome's Enhanced Protection mode in Safe Browsing, restricting access to untrusted web content via enterprise policy, and ensuring Site Isolation (--site-per-process) is active. Note that Site Isolation limits the blast radius of renderer compromises generally, reducing the attacker's ability to chain into this Lens flaw. No workaround that specifically neutralizes this Lens implementation flaw without patching has been identified.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today