Description
Inappropriate implementation in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-06-30
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A defect in the Paint component of Google Chrome allows a remote attacker to render user interface elements that appear legitimate but are deceptive. This flaw, classified as CWE‑451, can enable phishing or social‑engineering attacks by persuading users to trust bogus UI elements.

Affected Systems

The vulnerability affects all installations of Google Chrome with any version earlier than 150.0.7871.47. Only the Paint feature is implicated; other Chrome components are not impacted.

Risk and Exploitability

Chromium assigns a CVSS score of 4.3. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog. Attackers need to serve a crafted HTML page to a user, who must then load and interact with it for the spoofing to occur. No elevated privileges or code execution are required, but the deception can lead to the disclosure of sensitive information.

Generated by OpenCVE AI on August 3, 2026 at 06:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Chrome version 150.0.7871.47 or later, which addresses the paint component flaw (CWE-451).
  • Enable Chrome’s Safe Browsing and phishing detection features to help identify spoofed UI elements, mitigating exposure caused by insufficient UI checks (CWE-451).
  • Avoid loading or interacting with untrusted or locally hosted HTML files that could contain crafted UI, reducing the risk of UI spoofing (CWE-451).

Generated by OpenCVE AI on August 3, 2026 at 06:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4672-1 chromium security update
Debian DSA Debian DSA DSA-6378-1 chromium security update
History

Mon, 03 Aug 2026 07:00:00 +0000

Type Values Removed Values Added
Title Paint Component UI Spoofing Vulnerability in Google Chrome

Wed, 29 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
Title Paint Component UI Spoofing Vulnerability in Google Chrome

Tue, 21 Jul 2026 16:45:00 +0000

Type Values Removed Values Added
Title Chrome Paint UI Spoofing via Crafted HTML Page

Thu, 16 Jul 2026 00:00:00 +0000

Type Values Removed Values Added
Title Chrome Paint UI Spoofing via Crafted HTML Page

Tue, 14 Jul 2026 20:45:00 +0000

Type Values Removed Values Added
Title UI Spoofing via Paint Component in Google Chrome

Tue, 14 Jul 2026 01:15:00 +0000

Type Values Removed Values Added
Title UI Spoofing via Paint Component in Google Chrome

Sun, 12 Jul 2026 10:45:00 +0000

Type Values Removed Values Added
Title Chrome Paint Component UI Spoofing via Crafted HTML

Sat, 11 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Title Chrome Paint Component UI Spoofing via Crafted HTML

Fri, 10 Jul 2026 04:15:00 +0000

Type Values Removed Values Added
Title Paint Component UI Spoofing in Google Chrome

Thu, 09 Jul 2026 03:00:00 +0000

Type Values Removed Values Added
Title Paint Component UI Spoofing in Google Chrome

Tue, 07 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Title Inappropriate Paint Implementation Enables Remote UI Spoofing in Google Chrome

Tue, 07 Jul 2026 04:30:00 +0000

Type Values Removed Values Added
Title Inappropriate Paint Implementation Enables Remote UI Spoofing in Google Chrome

Mon, 06 Jul 2026 07:45:00 +0000

Type Values Removed Values Added
Title UI Spoofing in Chrome Paint via Crafted HTML Page

Sun, 05 Jul 2026 15:00:00 +0000

Type Values Removed Values Added
Title UI Spoofing in Chrome Paint via Crafted HTML Page

Sat, 04 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
Title Chrome Paint Component UI Spoofing Vulnerability

Sat, 04 Jul 2026 08:00:00 +0000

Type Values Removed Values Added
Title Chrome Paint Component UI Spoofing Vulnerability

Fri, 03 Jul 2026 05:30:00 +0000

Type Values Removed Values Added
Title UI Spoofing Vulnerability in Chrome Paint Component

Thu, 02 Jul 2026 09:15:00 +0000

Type Values Removed Values Added
Title UI Spoofing Vulnerability in Chrome Paint Component
Weaknesses CWE-79

Thu, 02 Jul 2026 02:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-451
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

Wed, 01 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
Title Chrome Paint UI Spoofing via Malicious HTML
Weaknesses CWE-79

Wed, 01 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Title Chrome Paint UI Spoofing via Malicious HTML
Weaknesses CWE-1031

Wed, 01 Jul 2026 11:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 01 Jul 2026 05:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1031

Tue, 30 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Description Inappropriate implementation in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-02T00:40:05.564Z

Reserved: 2026-06-29T23:04:05.200Z

Link: CVE-2026-13972

cve-icon Vulnrichment

Updated: 2026-07-01T19:26:21.585Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T06:45:03Z

Weaknesses
  • CWE-451

    User Interface (UI) Misrepresentation of Critical Information