Description
Inappropriate implementation in Isolated Web Apps in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
Published: 2026-06-30
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability allows a remote attacker to deliver a specially crafted HTML page that mimics the appearance of an isolated web app, misleading a user into believing the interface is legitimate. Because it is limited to user‑interface deception, it does not provide a path for code execution or data theft.

Affected Systems

All users of Google Chrome versions earlier than 150.0.7871.47 are impacted. The flaw is confined to the Isolated Web Apps component; other browser functions remain unaffected.

Risk and Exploitability

The CVSS base score of 4.3 indicates a low to medium potential impact, and the EPSS score of <1% suggests a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Successful exploitation requires delivering a malicious web page that serves the crafted HTML and a user interacting with the isolated app, making the risk largely a social‑engineering scenario.

Generated by OpenCVE AI on July 31, 2026 at 16:02 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 150.0.7871.47 or later.
  • Disable or restrict Isolated Web Apps if an upgrade is not immediately possible, for example by setting the appropriate policy or flag.
  • Educate users to verify the authenticity of interfaces when interacting with installed web apps.

Generated by OpenCVE AI on July 31, 2026 at 16:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4672-1 chromium security update
Debian DSA Debian DSA DSA-6378-1 chromium security update
History

Fri, 31 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Title UI Spoofing in Chrome Isolated Web Apps

Sat, 25 Jul 2026 23:30:00 +0000

Type Values Removed Values Added
Title UI Spoofing in Chrome Isolated Web Apps

Wed, 22 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Title Chrome Isolated Web Apps UI Spoofing Vulnerability

Fri, 17 Jul 2026 02:45:00 +0000

Type Values Removed Values Added
Title Chrome Isolated Web Apps UI Spoofing Vulnerability

Tue, 14 Jul 2026 11:45:00 +0000

Type Values Removed Values Added
Title UI Spoofing Vulnerability in Chrome Isolated Web Apps

Sun, 12 Jul 2026 10:45:00 +0000

Type Values Removed Values Added
Title UI Spoofing Vulnerability in Chrome Isolated Web Apps

Sat, 11 Jul 2026 02:45:00 +0000

Type Values Removed Values Added
Title Google Chrome Isolated Web Apps UI Spoofing Vulnerability

Thu, 09 Jul 2026 15:15:00 +0000

Type Values Removed Values Added
Title Google Chrome Isolated Web Apps UI Spoofing Vulnerability

Wed, 08 Jul 2026 19:45:00 +0000

Type Values Removed Values Added
Title Google Chrome Isolated Web Apps UI Spoofing Vulnerability

Tue, 07 Jul 2026 21:30:00 +0000

Type Values Removed Values Added
Title Google Chrome Isolated Web Apps UI Spoofing Vulnerability

Tue, 07 Jul 2026 04:00:00 +0000

Type Values Removed Values Added
Title UI Spoofing Vulnerability in Google Chrome Isolated Web Apps

Mon, 06 Jul 2026 03:30:00 +0000

Type Values Removed Values Added
Title UI Spoofing Vulnerability in Google Chrome Isolated Web Apps

Sun, 05 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Title UI Spoofing via Isolated Web Apps in Google Chrome

Sat, 04 Jul 2026 19:45:00 +0000

Type Values Removed Values Added
Title UI Spoofing via Isolated Web Apps in Google Chrome

Sat, 04 Jul 2026 07:45:00 +0000

Type Values Removed Values Added
Title UI Spoofing via Crafted HTML in Chrome Isolated Web Apps

Fri, 03 Jul 2026 16:45:00 +0000

Type Values Removed Values Added
Title UI Spoofing via Crafted HTML in Chrome Isolated Web Apps

Thu, 02 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
Title UI Spoofing via Crafted HTML in Chrome Isolated Web Apps

Thu, 02 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Title UI Spoofing via Crafted HTML in Chrome Isolated Web Apps

Wed, 01 Jul 2026 22:15:00 +0000

Type Values Removed Values Added
Title UI Spoofing via Inappropriate Isolated Web Apps Implementation in Google Chrome
Weaknesses CWE-79

Wed, 01 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-451
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 12:00:00 +0000

Type Values Removed Values Added
Title UI Spoofing via Inappropriate Isolated Web Apps Implementation in Google Chrome
Weaknesses CWE-79

Wed, 01 Jul 2026 07:45:00 +0000

Type Values Removed Values Added
Title UI Spoofing via Inadequate Isolated Web Apps Implementation in Chrome
First Time appeared Google
Google chrome
Weaknesses CWE-663
Vendors & Products Google
Google chrome

Wed, 01 Jul 2026 02:30:00 +0000

Type Values Removed Values Added
Title UI Spoofing via Inadequate Isolated Web Apps Implementation in Chrome
Weaknesses CWE-663

Tue, 30 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Description Inappropriate implementation in Isolated Web Apps in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-01T14:33:07.363Z

Reserved: 2026-06-29T23:11:30.331Z

Link: CVE-2026-14042

cve-icon Vulnrichment

Updated: 2026-07-01T14:33:01.949Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T16:15:03Z

Weaknesses
  • CWE-451

    User Interface (UI) Misrepresentation of Critical Information