Description
Inappropriate implementation in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)
Published: 2026-05-06
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An inappropriate implementation in Chrome DevTools before version 148.0.7778.96 allows a malicious extension to spoof the browser’s user interface. This can mislead a user into interacting with counterfeit UI elements, potentially undermining user confidence and leading to deceptive interactions.

Affected Systems

Google Chrome on all platforms that deploy the stable channel, for any version prior to 148.0.7778.96. The flaw exists in the DevTools component as delivered by Google and can be triggered by any extension installed through the Chrome Web Store or other installation methods.

Risk and Exploitability

The CVSS score is 5.4 and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user to install a malicious extension, reducing the likelihood of widespread attack. Although the severity is low, the presence of UI deception warrants timely patching.

Generated by OpenCVE AI on May 7, 2026 at 03:12 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Chrome version 148.0.7778.96 or later
  • Limit extensions to trusted sources only
  • Approve extensions before installation and review their permissions
  • Enforce Chrome Enterprise policies that block or quarantine unknown extensions

Generated by OpenCVE AI on May 7, 2026 at 03:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 07 May 2026 01:15:00 +0000

Type Values Removed Values Added
Title Chrome DevTools UI Spoofing via Malicious Extension
Weaknesses CWE-74
CWE-79

Thu, 07 May 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 06 May 2026 23:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 06 May 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-451
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L'}

Wed, 06 May 2026 20:30:00 +0000

Type Values Removed Values Added
Title Chrome DevTools UI Spoofing via Malicious Extension
Weaknesses CWE-74
CWE-79

Wed, 06 May 2026 18:30:00 +0000

Type Values Removed Values Added
Description Inappropriate implementation in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-05-06T21:47:21.898Z

Reserved: 2026-05-05T22:59:33.841Z

Link: CVE-2026-8008

cve-icon Vulnrichment

Updated: 2026-05-06T21:18:00.508Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-05-06T19:16:51.773

Modified: 2026-05-06T22:16:45.020

Link: CVE-2026-8008

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-07T03:15:20Z

Weaknesses