Description
Inappropriate implementation in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-06-30
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the Paint component of Google Chrome allows remote attackers to render user interface elements that look legitimate but are actually deceptive, enabling phishing or social‑engineering attacks. The vulnerability, classified as CWE‑451, leads to UI spoofing without granting arbitrary code execution. Attackers may trick users into submitting sensitive information by presenting forged interface elements.

Affected Systems

Vulnerable users are those running Google Chrome on desktop, stable channel, with any version earlier than 150.0.7871.47. Only the Paint feature is impacted; no other Chrome components are affected.

Risk and Exploitability

Chromium rates the issue as medium severity with a CVSS score of 4.3. The EPSS score is less than 1% and it is not listed in CISA’s KEV catalog. The likely attack vector is remote: a maliciously crafted HTML page must be loaded by the user, who then interacts with the spoofed UI, but the vulnerability does not allow code execution.

Generated by OpenCVE AI on July 15, 2026 at 23:44 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Chrome version 150.0.7871.47 or later to receive the Paint UI rendering fix
  • Enable Chrome’s Safe Browsing and phishing detection features to help identify potential spoofing attempts
  • Avoid opening untrusted or locally hosted HTML files that could contain crafted UI
  • Check the Google Chrome website for the latest security updates and patches

Generated by OpenCVE AI on July 15, 2026 at 23:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4672-1 chromium security update
Debian DSA Debian DSA DSA-6378-1 chromium security update
History

Thu, 16 Jul 2026 00:00:00 +0000

Type Values Removed Values Added
Title Chrome Paint UI Spoofing via Crafted HTML Page

Tue, 14 Jul 2026 20:45:00 +0000

Type Values Removed Values Added
Title UI Spoofing via Paint Component in Google Chrome

Tue, 14 Jul 2026 01:15:00 +0000

Type Values Removed Values Added
Title UI Spoofing via Paint Component in Google Chrome

Sun, 12 Jul 2026 10:45:00 +0000

Type Values Removed Values Added
Title Chrome Paint Component UI Spoofing via Crafted HTML

Sat, 11 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Title Chrome Paint Component UI Spoofing via Crafted HTML

Fri, 10 Jul 2026 04:15:00 +0000

Type Values Removed Values Added
Title Paint Component UI Spoofing in Google Chrome

Thu, 09 Jul 2026 03:00:00 +0000

Type Values Removed Values Added
Title Paint Component UI Spoofing in Google Chrome

Tue, 07 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Title Inappropriate Paint Implementation Enables Remote UI Spoofing in Google Chrome

Tue, 07 Jul 2026 04:30:00 +0000

Type Values Removed Values Added
Title Inappropriate Paint Implementation Enables Remote UI Spoofing in Google Chrome

Mon, 06 Jul 2026 07:45:00 +0000

Type Values Removed Values Added
Title UI Spoofing in Chrome Paint via Crafted HTML Page

Sun, 05 Jul 2026 15:00:00 +0000

Type Values Removed Values Added
Title UI Spoofing in Chrome Paint via Crafted HTML Page

Sat, 04 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
Title Chrome Paint Component UI Spoofing Vulnerability

Sat, 04 Jul 2026 08:00:00 +0000

Type Values Removed Values Added
Title Chrome Paint Component UI Spoofing Vulnerability

Fri, 03 Jul 2026 05:30:00 +0000

Type Values Removed Values Added
Title UI Spoofing Vulnerability in Chrome Paint Component

Thu, 02 Jul 2026 09:15:00 +0000

Type Values Removed Values Added
Title UI Spoofing Vulnerability in Chrome Paint Component
Weaknesses CWE-79

Thu, 02 Jul 2026 02:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-451
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

Wed, 01 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
Title Chrome Paint UI Spoofing via Malicious HTML
Weaknesses CWE-79

Wed, 01 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Title Chrome Paint UI Spoofing via Malicious HTML
Weaknesses CWE-1031

Wed, 01 Jul 2026 11:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 01 Jul 2026 05:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1031

Tue, 30 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Description Inappropriate implementation in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-02T00:40:05.564Z

Reserved: 2026-06-29T23:04:05.200Z

Link: CVE-2026-13972

cve-icon Vulnrichment

Updated: 2026-07-01T19:26:21.585Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-15T23:45:16Z

Weaknesses
  • CWE-451

    User Interface (UI) Misrepresentation of Critical Information