EUVD-2026-79991
GHSA-9qfv-7xp3-8h7q
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L
PR:N retained per Chrome's threat model treating the renderer as untrusted, but AC:H and UI:R reflect the required prior renderer compromise and victim interaction; impact limited to UI spoofing (C:L/A:L, I:N).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Missing authorization in Browser in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
UI spoofing in Google Chrome versions prior to 153.0.8010.47 allows an attacker who has already compromised the browser's renderer process to draw convincing but fake interface elements in front of the user via a crafted HTML page. The flaw is a missing authorization check (CWE-862) on a browser-side privileged capability, rated Medium by the Chromium team and scored 4.2 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L), with impact limited to Low confidentiality and Low availability and no integrity effect. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to have ALREADY compromised the renderer process of Google Chrome (versions prior to 153.0.8010.47) - this is the explicit, mandatory precondition stated in the advisory, not incidental. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-priority issue despite the CRITICAL-sounding CWE label. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Chrome 153.0.8010.47 (and later). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today