EUVD-2026-89403
GHSA-23rw-g2pq-xf22
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage manipulates TabStrip rendering
-
ExecutionBrowser UI elements misrepresented
-
ImpactUser deceived for phishing/social engineering
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security UI security representation
|
| Exploitation Conditions | Exploitation requires the victim to open a crafted HTML page in an affected Chrome build (prior to 154.0.8037.92), consistent with UI:R in the CVSS vector; the attacker needs no authentication (PR:N) and no special server-side privileges. The limiting factor is that success yields only UI misrepresentation within the TabStrip to support deception - there is no code execution, memory corruption, or direct data theft - and the user must both visit the page and be fooled by the spoofed chrome for any real-world harm. Auto-updated Chrome installations at or above 154.0.8037.92 are not affected. |
| Impact | This is a genuinely low-priority issue despite the ubiquitous product. The CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) reflects a network-reachable, low-complexity, unauthenticated flaw, but one that requires user interaction (UI:R - the victim must visit a crafted page) and delivers only low-magnitude impact (C:L/A:L, I:N). Chromium itself rated the security severity 'Low.' All exploitation signals point the same direction: SSVC records Exploitation=none, Automatable=no, and Technical Impact=partial; there is no CISA KEV listing and no public exploit code identified. This is a UI-spoofing/misrepresentation weakness (CWE-451) in the TabStrip, meaning its worst-case use is deceiving a user into misreading browser chrome to support phishing or social engineering - not code execution, sandbox escape, or data theft. The signals are internally consistent (no conflict between CVSS, SSVC, and vendor severity). One note: the input Tag 'Information Disclosure' overstates and mischaracterizes the flaw, which is a spoofing/deception issue with only incidental C:L, not a disclosure primitive. Patch remedy exists, so the correct posture is routine Chrome auto-update rather than emergency action. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page and lures a Chrome user (via phishing link, malvertising, or a compromised site) into visiting it. The page manipulates TabStrip rendering to misrepresent UI elements, making the user believe they are on a different or trusted tab/site, which can bolster a credential-phishing or social-engineering lure. No public proof-of-concept has been identified, and the payoff is deception only - no code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
UI misrepresentation in the TabStrip component of Google Chrome prior to 154.0.8037.92 lets a remote attacker spoof browser UI elements by luring a victim to a crafted HTML page, rated CVSS 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) and Chromium security severity Low. No authentication or special privileges are required, but the victim must open the malicious page and be deceived by the spoofed chrome, and the outcome is limited to UI deception - no code execution, memory corruption, or direct data exfiltration has been demonstrated. There is no CISA KEV listing and no public exploit code identified at time of analysis, and auto-updated installations at or above 154.0.8037.92 are not affected.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 154.0.8037.92 or later, as documented in the Chrome stable channel advisory (https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01807488085.html) and tracked in the Chromium issue at https://issues.chromium.org/issues/514059780. Because Chrome auto-updates by default, most users only need to relaunch the browser to complete the update; verify the installed build via chrome://version and confirm managed fleets through enterprise update policies. There is no configuration flag or toggle that disables TabStrip rendering to work around this issue, so organizations that cannot patch immediately should rely on compensating controls with known trade-offs: block or restrict access to untrusted web content through URL filtering and category-based policy (loses access to legitimate sites in filtered categories), run untrusted browsing inside a disposable or isolated browser environment such as a remote browser isolation service or throwaway profile (adds latency and breaks session continuity), and pair these with user awareness guidance that browser chrome indicators should not be trusted from unverified pages (weak control, human error remains likely). Given the Low severity, no KEV listing, no public exploit code, and SSVC rating of Exploitation: none / Automatable: no / Technical Impact: partial, remediation should follow normal patch cadence rather than emergency change procedures.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is classified as CWE-451, User Interface (UI) Misrepresentation of Critical Information, and lives in Chrome's TabStrip - the browser-level tab bar that renders trusted chrome separate from web content. Browsers enforce a strict trust boundary between the privileged browser UI and untrusted page-rendered content; a flaw in how TabStrip representations are validated or drawn can let attacker-controlled HTML cause the tab strip to display misleading elements, undermining the assumption that the browser chrome is trustworthy. Affected builds are identified by the CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with the fix boundary at version 154.0.8037.92, and EUVD-2026-89403 records the affected range as Chrome releases below 154.0.8037.92. Because Chromium-based browsers share this code, downstream vendors typically inherit the fix through their own upstream rebases. The CVSS vector confirms the attack is network-delivered and unauthenticated (PR:N) but requires user interaction (UI:R) and results only in partial confidentiality and availability impact (C:L/A:L) with no integrity or scope change, matching the Low severity assigned by Chromium.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Remote crafted page (AV:N/AC:L/PR:N) needs victim visit (UI:R); UI spoofing gives only minor confidentiality/availability effect (C:L/A:L, I:N), consistent with Chromium's Low rating.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
UI misrepresentation in TabStrip in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Exploit-DB