EUVD-2026-66037
GHSA-984q-h4fm-4hvf
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network-delivered UI spoofing requires no attacker privileges but mandatory user interaction; impact is integrity-only as no data is disclosed and no system availability is affected.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
UI misrepresentation in PermissionElement in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Chrome's PermissionElement component can be visually spoofed via a crafted HTML page, allowing a remote attacker to mislead users into granting browser permissions they did not intend to approve. All Chrome desktop versions prior to 152.0.7977.65 are affected, as confirmed by the vendor's Stable Channel advisory and EUVD-2026-66037. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to visit a crafted HTML page served by the attacker and to interact with the spoofed PermissionElement - social engineering is explicitly stated as a prerequisite in the CVE description. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.3 base score is technically reasonable: the attack is network-delivered (AV:N), low complexity (AC:L), requires no attacker privileges (PR:N), but mandates user interaction (UI:R), with impact confined to integrity (I:L) and no confidentiality or availability effects. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts an HTML page that manipulates Chrome's PermissionElement rendering to display a spoofed permission dialog - for instance, making a microphone or geolocation access request visually indistinguishable from a harmless UI control or a trusted system prompt. A user visiting the page via a phishing link or malvertising is deceived into clicking through the spoofed prompt, unknowingly granting the attacker's origin access to a sensitive browser capability. … |
| Remediation | Vendor-released patch: Chrome 152.0.7977.65. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today