Description
Inappropriate implementation in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)
Published: 2026-05-06
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An inappropriate implementation in Chrome DevTools before version 148.0.7778.96 allows a malicious extension to spoof the browser’s user interface. This can mislead a user into interacting with counterfeit UI elements, potentially undermining user confidence and leading to deceptive interactions.

Affected Systems

Google Chrome on all platforms that deploy the stable channel, for any version prior to 148.0.7778.96. The flaw exists in the DevTools component as delivered by Google and can be triggered by any extension installed through the Chrome Web Store or other installation methods.

Risk and Exploitability

The CVSS score is 5.4 and the EPSS score is < 1% (0.00018). The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user to install a malicious extension, reducing the likelihood of widespread attack. Although the severity is low, the presence of UI deception warrants timely patching.

Generated by OpenCVE AI on May 9, 2026 at 04:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Chrome version 148.0.7778.96 or later
  • Limit extensions to trusted sources only
  • Approve extensions before installation and review their permissions
  • Enforce Chrome Enterprise policies that block or quarantine unknown extensions

Generated by OpenCVE AI on May 9, 2026 at 04:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6250-1 chromium security update
History

Sat, 09 May 2026 00:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Inappropriate implementation in DevTools
Weaknesses CWE-1021
References
Metrics threat_severity

None

 threat_severity

Low

Thu, 07 May 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows

Thu, 07 May 2026 01:15:00 +0000

Type Values Removed Values Added
Title Chrome DevTools UI Spoofing via Malicious Extension
Weaknesses CWE-74
CWE-79

Thu, 07 May 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 06 May 2026 23:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 06 May 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-451
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L'}

Wed, 06 May 2026 20:30:00 +0000

Type Values Removed Values Added
Title Chrome DevTools UI Spoofing via Malicious Extension
Weaknesses CWE-74
CWE-79

Wed, 06 May 2026 18:30:00 +0000

Type Values Removed Values Added
Description Inappropriate implementation in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)
References

Subscriptions

Apple Macos
Google Chrome
Linux Linux Kernel
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-05-06T21:47:21.898Z

Reserved: 2026-05-05T22:59:33.841Z

Link: CVE-2026-8008

cve-icon Vulnrichment

Updated: 2026-05-06T21:18:00.508Z

cve-icon NVD

Status : Analyzed

Published: 2026-05-06T19:16:51.773

Modified: 2026-05-07T15:17:23.163

Link: CVE-2026-8008

cve-icon Redhat

Severity : Low

Publid Date: 2026-05-05T00:00:00Z

Links: CVE-2026-8008 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-05-09T04:15:06Z

Weaknesses