EUVD-2026-93648
GHSA-4m2j-q788-cr5w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim into Chromoting session
-
DeliverySend crafted network traffic
-
ExploitRender spoofed UI elements
-
ExecutionVictim acts on false interface
-
ImpactTrust decision manipulated
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security UI security representation
|
| Exploitation Conditions | Exploitation requires the victim to be using the Chromoting (Chrome Remote Desktop) functionality of Google Chrome on Windows at a version prior to 155.0.8059.39, and requires active user interaction (UI:R) driven by social engineering - the attacker cannot succeed silently. The attacker must be able to deliver crafted network traffic to the Chromoting component during a session. Limiting factors: the mandatory social-engineering/user-interaction step, dependence on the specific Windows platform and vulnerable version, and the fact that Chrome's automatic update channel rapidly shrinks the exposed population. No authentication or elevated privileges are needed (PR:N), but the human-in-the-loop requirement substantially caps realistic risk. |
| Impact | This is a genuinely low-priority issue despite the moderate 5.4 CVSS score. The CVSS vector (AV:N/AC:L/PR:N/UI:R) shows network reach with no privileges required, but the UI:R flag means a victim must be actively tricked, and the impact is limited to spoofing UI elements (C:L/I:N/A:L, scope unchanged) rather than code execution or data theft. Chromium itself rated the security severity 'Low'. All exploitation signals point the same direction: CISA SSVC lists Exploitation=none, Automatable=no, and Technical Impact=partial, there is no CISA KEV listing, and no public exploit code is referenced - so EPSS-style real-world exploitation probability is effectively minimal. The one internal tension is the CVSS impact set: A:L (availability) is an unusual choice for a pure UI-misrepresentation/spoofing flaw (CWE-451), where integrity of displayed information is the more natural impact - this is worth verifying with the vendor but does not change the overall low-risk conclusion. Net: a real-but-minor social-engineering aid, not an urgent patch priority beyond normal Chrome auto-update hygiene. |
| Exploit ScenarioDerived | An attacker lures a Windows user running an affected Chrome build into a session where crafted network traffic reaches the Chromoting (Chrome Remote Desktop) component, causing spoofed or misleading UI elements to render. The victim, trusting the falsified interface, is manipulated into making a bad trust decision (e.g., approving a connection or disclosing information). No public exploit code has been identified, and successful exploitation hinges on the social-engineering lure succeeding. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
UI spoofing in the Chromoting (Chrome Remote Desktop) component of Google Chrome on Windows prior to 155.0.8059.39 lets an unauthenticated remote attacker misrepresent interface elements to a victim, but only after the user has been socially engineered into interacting with crafted network traffic. The attack cannot succeed silently: it requires the victim to be actively using Chromoting while the crafted traffic is delivered, and it yields at most limited information exposure - our assessment scores it CVSS 5.4 with low confidentiality impact and no integrity or availability impact. No public exploit was identified at time of analysis, and Google has addressed the flaw in 155.0.8059.39, so this is a low-priority issue for environments that keep Chrome current on the stable update channel.
RemediationAI
Upgrade Google Chrome on Windows to version 155.0.8059.39 or later - this is the exact fix released by the vendor per the Chrome stable channel advisory (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html and https://issues.chromium.org/issues/556233068) - and confirm the applied build via chrome://settings/help, restarting the browser so the update takes effect; because Chrome ships on an automatic update channel, most consumer and managed endpoints will close the exposure simply by staying current, and enterprise administrators should use their packaging/update tooling to push 155.0.8059.39 ahead of the automatic schedule. If immediate updating is not possible, the most effective compensating control is to disable the Chromoting / Chrome Remote Desktop host component and block remote-session capability via the RemoteAccessHostFirewallTraversal and RemoteAccessHostAllowRemoteAccessConnections administrative policies (or equivalent enterprise policy restricting Chrome Remote Desktop), accepting the trade-off that legitimate remote support sessions will stop working until the browser is patched; additionally, restrict who can initiate or receive remote sessions through network segmentation and host-side firewall rules, recognizing that these controls reduce the number of users who can be socially engineered into the vulnerable interaction but do not remove the underlying defect. Because exploitation is neither confirmed in the wild nor assessed as automatable and depends on a human-in-the-loop social-engineering step, patching on the normal update cadence is sufficient and no emergency mitigation is required.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-451 (User Interface (UI) Misrepresentation of Critical Information), a spoofing weakness in which the application renders interface elements that do not faithfully represent the underlying state. Chromoting is Chrome's remote desktop capability (commercially surfaced as Chrome Remote Desktop): the browser negotiates a session with a remote host and renders the remote framebuffer and UI chrome locally, which means data arriving over the network participates in what the user sees. In affected builds the Chromoting component could be induced, via crafted network traffic, to display spoofed UI elements that a socially engineered victim may trust or act upon - the manipulation is visual/semantic rather than a memory-safety compromise. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L confirms network reachability, no privileges required, and a mandatory user-interaction step; our independent assessment revises impact to C:L/I:N/A:N, i.e. limited confidentiality exposure only, with no demonstrated integrity or availability effect, which is consistent with the reported Chromium security severity of Low and with CISA's SSVC decision (Exploitation: none, Automatable: no, Technical Impact: partial). The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* identifies Google Chrome as the affected product, and the defect is specific to the Windows platform builds of Chrome prior to 155.0.8059.39.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Network-reachable with no privileges but mandatory user interaction (UI:R); a UI-spoofing flaw yields only minor confidentiality exposure (C:L), with no genuine integrity or availability impact, so I drop the vendor's A:L.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
UI misrepresentation in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB