Description
Insufficient validation of untrusted input in Wallet in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
Published: 2026-06-04
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Insufficient validation of untrusted input in Google Chrome Wallet prior to version 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. The weakness is a form of CWE‑20 "Improper Input Validation" and could make users interact with fraudulent wallet interfaces, potentially exposing sensitive data or enabling transaction manipulation.

Affected Systems

Google Chrome desktop versions earlier than 149.0.7827.53 are affected.

Risk and Exploitability

The vulnerability is rated low by Chromium’s security team and is not listed in the CISA KEV catalog. With no EPSS score available the likelihood of exploitation appears minimal, especially since it requires prior compromise of the renderer process. Nonetheless, the potential for user deception exists, and updating Chrome mitigates the risk.

Generated by OpenCVE AI on June 5, 2026 at 00:43 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 149.0.7827.53 or later to fix the input validation flaw in the Wallet module.
  • If an upgrade cannot be applied immediately, disable the Wallet feature or remove the relevant extension to eliminate the vulnerable code path.
  • Apply Chrome’s Site Isolation and Safe Browsing protections and monitor user interfaces for unexpected UI elements until a patch is available.

Generated by OpenCVE AI on June 5, 2026 at 00:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 05 Jun 2026 03:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Fri, 05 Jun 2026 01:00:00 +0000

Type Values Removed Values Added
Title Potential UI Spoofing via Untrusted Input in Google Chrome Wallet

Thu, 04 Jun 2026 23:45:00 +0000

Type Values Removed Values Added
Description Insufficient validation of untrusted input in Wallet in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
Weaknesses CWE-20
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-06-04T23:06:18.874Z

Reserved: 2026-06-04T17:11:15.848Z

Link: CVE-2026-11286

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-06-05T00:17:06.057

Modified: 2026-06-05T00:17:06.057

Link: CVE-2026-11286

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-05T03:00:06Z

Weaknesses