CVE-2026-121122 in Chrome
Summary
by MITRE • 11/03/2026
UI misrepresentation in Prompts in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified as a user interface misrepresentation within the Chromium-based Google Chrome browser prior to version 157.0.8103.38 represents a significant class of social engineering risks known as UI redressing or clickjacking variants. This flaw allows an attacker, through a specially crafted HTML page hosted on a malicious website, to manipulate how certain prompts and dialog boxes are rendered in the user's browser window. By exploiting inconsistencies in how the rendering engine handles overlaying elements, positioning, and z-index stacking contexts, the attacker can visually disguise the true nature of interactive UI components. This technique does not involve breaking into the browser’s core security boundaries or executing arbitrary code directly; rather, it relies on deceiving the user by making a malicious action appear as a benign system prompt or a trusted interface element from another site.
From a technical perspective, this vulnerability falls under the category of CWE-20: Improper Input Validation and more specifically aligns with CWE-831: Action URL Manipulation when it involves tricking users into clicking unintended targets, though in this specific context regarding prompt spoofing, it is closely related to CWE-798: Use of Hard-coded Credentials if the spoofed UI mimics authentication dialogs. The core issue lies in the browser's failure to enforce strict visual boundaries or contextual indicators that distinguish between content originating from different origins when rendering modal prompts. An attacker can position a transparent overlay over a legitimate-looking prompt, such as one requesting permission for location access or microphone usage, while capturing clicks intended for the underlying malicious element. Alternatively, they may alter the text displayed in standard browser dialogs to mimic trusted entities, thereby lowering the user's skepticism and increasing the likelihood of consent being granted to harmful actions.
The operational impact of this vulnerability is primarily centered on social engineering success rates rather than direct system compromise. When a user interacts with a spoofed prompt, they are likely to grant permissions or provide sensitive information under the false assumption that the request originates from a trusted source or represents a standard browser security warning. This can lead to unauthorized access to device features such as cameras, microphones, and geolocation services. In more severe scenarios involving phishing pages designed to mimic login screens for banking or email providers, users may inadvertently submit their credentials directly to the attacker’s server. The medium severity rating assigned by Chromium reflects that while the vulnerability is exploitable with minimal user interaction beyond clicking a link, it requires active social engineering and does not allow for silent exploitation without any visual deception.
Mitigation strategies for this type of vulnerability require both immediate patching and long-term architectural improvements. Users must update Google Chrome to version 157.0.8103.38 or later, where the rendering engine has been patched to prevent these specific UI manipulation techniques. For developers and security architects, addressing such issues involves implementing robust Content Security Policy directives that restrict framing and overlaying of sensitive elements across origins. Additionally, browsers are increasingly adopting stricter origin isolation policies and visual cues like lock icons in address bars for secure contexts to help users verify the authenticity of the domain they are interacting with. From an ATT&CK framework perspective, this vulnerability facilitates techniques under Tactic TA0001: Initial Access, specifically leveraging social engineering via UI redressing (T1568), and potentially contributes to Credential Access if used in conjunction with phishing campaigns. Organizations should enforce automated browser update policies and educate users on verifying the domain name displayed in address bars before interacting with any prompts requesting sensitive permissions or data entry.