EUVD-2026-93854
GHSA-84f4-wmrw-gr3q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim via social engineering
-
DeliveryInstall crafted Chrome extension
-
ExploitTrigger incorrect calculation in API
-
ExecutionRender spoofed UI elements
-
ImpactDeceive user into trusting fake interface
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Calculation correctness
|
| Exploitation Conditions | Exploitation requires the victim to install and interact with an attacker-supplied crafted Chrome extension on Windows, obtained through social engineering - this is the exact precondition stated in the description and is reflected by UI:R in the CVSS vector. It is limited to Chrome versions prior to 155.0.8059.39 on Windows. The dependence on a user both installing an untrusted extension and then acting on the spoofed UI substantially narrows realistic exploitation; it cannot occur against a default, unmodified browser without this user-driven extension installation. |
| Impact | This is a genuinely low-to-moderate priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L, score 5.4) reflects a medium-severity UI-spoofing flaw, consistent with Chromium's own 'Medium' rating. Although PR:N indicates no privileges are required, exploitation is gated by UI:R: the attacker must use social engineering to get a victim to install and interact with a crafted Chrome extension - a meaningful real-world barrier. No EPSS score was provided, there is no CISA KEV listing, and no public proof-of-concept is referenced, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The one mild tension in the data is that the CVSS vector marks C:L and A:L, yet the described impact is UI spoofing (CWE-682, Incorrect Calculation) - the confidentiality/availability impact is indirect, arising only after a user is deceived by the spoofed UI. Overall, standard patch-cycle prioritization is appropriate; this does not warrant emergency out-of-band action. |
| Exploit ScenarioDerived | An attacker publishes or distributes a malicious Chrome extension and uses social engineering (phishing, fake software prompts) to convince a Windows user to install it. Once active, the extension abuses the incorrect calculation in the affected API to render spoofed or misleading UI elements, tricking the victim into trusting fraudulent content or interface prompts. No public exploit code is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
UI spoofing in Google Chrome on Windows prior to 155.0.8059.39 allows an unauthenticated remote attacker (PR:N) to misrepresent browser interface elements to a victim who has installed and interacted with a crafted Chrome extension obtained through social engineering, as reflected by UI:R in the CVSS vector. The incorrect calculation (CWE-682) in an API erodes user trust in what Chrome displays, but the assessed impact is limited to low confidentiality and low availability with no integrity impact (C:L/I:N/A:L). A vendor-released patch exists in Chrome 155.0.8059.39, no public exploit has been identified at time of analysis, and the overall risk is a genuinely low-to-moderate priority issue rather than a top-tier emergency.
RemediationAI
Apply the vendor-released patch by upgrading Google Chrome on Windows to 155.0.8059.39 or later through the built-in updater (chrome://settings/help) or an enterprise software-deployment tool, and confirm the new version afterward; the advisory is at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html and the tracking issue at https://issues.chromium.org/issues/477327257. Because the flaw requires a crafted extension that the user installs via social engineering, interim compensating controls are worth applying where immediate patching is not possible: enforce an enterprise extension policy that restricts installation to an allowlist (for example, ExtensionInstallAllowlist plus ExtensionInstallBlocklist set to '*') so unvetted extensions cannot load-accepting that this reduces legitimate extension flexibility and requires policy maintenance; and disable developer-mode extension loading where it is not business-justified, understanding that this can interfere with internal testing workflows. User awareness training on unsolicited extension installation requests adds defense in depth but is not a technical control, and no public exploit has been identified at time of analysis, so the update remains the primary and recommended action.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-682 (Incorrect Calculation) in a Chrome API exposed to extensions; this class of bug typically arises when a computed value-an offset, a size, a permission check result, or a bounding calculation-does not match the intended semantics, allowing an extension to supply or trigger data that the browser then renders as trusted UI. Because extensions request and receive host permissions at install time, a malicious or compromised extension can already draw its own windows and badges, but this flaw lets it make those elements appear as genuine Chrome chrome-dialogs, prompts, or address-bar affordances-so users are misled into acting on spoofed content. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L shows the attack is network-reachable with low complexity and needs no attacker-controlled credentials, yet it requires the victim to install the extension and interact with the spoofed UI (UI:R), and the scope is unchanged. Affected code is in Chrome on Windows; the CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers the Chrome product broadly, while the description and EUVD data pin the vulnerable range to versions strictly earlier than 155.0.8059.39. Chromium security severity is Medium, consistent with the independent assessment.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Remotely delivered extension (AV:N) with no prior privileges (PR:N) but mandatory user installation/interaction (UI:R); UI spoofing yields only limited, indirect C and A impact and no integrity impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Incorrect calculation in API in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB