Description
Incorrect security UI in Autofill in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-06-30
Score: 4.2 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Google Chrome on Windows has a flaw in the Autofill security UI that allows a remote attacker to craft an HTML page which, when a user interacts with it, displays a spoofed interface. This manipulation can lead the user to submit gestures or data believing the UI is legitimate, thereby exposing sensitive information or enabling credential theft. The vulnerability is a medium severity issue reported by Chromium.

Affected Systems

Versions of Google Chrome for Windows earlier than 150.0.7871.47 are affected.

Risk and Exploitability

Because the exploit requires a crafted web page and active user participation, the likelihood of a widespread attack is limited, yet it remains possible in targeted phishing campaigns. No EPSS value is available and the vulnerability is not listed in the CISA KEV catalog. The current medium severity reflects the potential for deception but not for arbitrary code execution.

Generated by OpenCVE AI on July 1, 2026 at 14:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Chrome version 150.0.7871.47 or later to receive the security fix.
  • Disable or limit Autofill suggestions for password and form data in Chrome settings to prevent accidental submission on suspicious pages.
  • Ensure Chrome’s Safe Browsing and phishing protection features are enabled to reduce the risk of malicious content presented to the user.

Generated by OpenCVE AI on July 1, 2026 at 14:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4672-1 chromium security update
Debian DSA Debian DSA DSA-6378-1 chromium security update
History

Wed, 01 Jul 2026 08:30:00 +0000

Type Values Removed Values Added
Title UI Spoofing via Autofill in Google Chrome on Windows
Weaknesses CWE-640

Wed, 01 Jul 2026 08:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 01 Jul 2026 03:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-451
Metrics cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 01:30:00 +0000

Type Values Removed Values Added
Title UI Spoofing via Autofill in Google Chrome on Windows
Weaknesses CWE-640

Tue, 30 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Description Incorrect security UI in Autofill in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-01T02:00:12.193Z

Reserved: 2026-06-29T23:03:35.887Z

Link: CVE-2026-13860

cve-icon Vulnrichment

Updated: 2026-07-01T01:52:58.634Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-01T14:30:05Z

Weaknesses
  • CWE-451

    User Interface (UI) Misrepresentation of Critical Information