Executive brief
Google Chrome, a widely used web browser, contained a vulnerability that could allow a malicious website to misrepresent its identity. If a user visits a specially crafted page, an attacker who has already partially compromised the browser's internal processing could trick the user into believing they are on a different, legitimate website. This type of 'spoofing' is often used to steal login credentials or other sensitive information by mimicking trusted sites.
Technical details
A UI spoofing vulnerability exists in the Navigation component of Google Chrome due to insufficient validation of untrusted input. The flaw allows a remote attacker to manipulate the browser's user interface, potentially misrepresenting the origin or state of a web page. A precondition for this exploit is that the attacker must have already compromised the renderer process. By leveraging a crafted HTML page, the attacker can then bypass navigation checks to perform UI spoofing. This issue was addressed in Chrome version 151.0.7922.72.
Affected products
- Google Chrome prior to 151.0.7922.72
Timeline
- 2026-07-29: patched: Fixed in version 151.0.7922.72 for Windows/Mac and 151.0.7922.71 for Linux.
- 2026-07-30: disclosed