CVE-2026-121162 in Chrome
Summary
by MITRE • 11/03/2026
UI misrepresentation in Notifications in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified as CVE-2024-6968 represents a user interface misrepresentation flaw within the notification system of Google Chrome for Windows, specifically affecting versions prior to 157.0.8103.38. This security issue stems from an inconsistency in how the browser renders and displays notifications generated by web pages compared to their actual origin or intent. The core technical flaw lies in the rendering engine's handling of notification metadata, which allows a crafted HTML page to manipulate visual elements such as titles, icons, or action buttons to mimic legitimate system prompts or trusted applications. By exploiting this discrepancy, an attacker can create a deceptive user interface that appears authentic but is fundamentally malicious, thereby bypassing standard user trust mechanisms that rely on visual cues for authentication and verification.
From an operational perspective, the impact of this vulnerability is primarily tied to social engineering attacks rather than direct code execution or data exfiltration through technical exploits alone. A remote attacker can host a specially crafted webpage designed to trigger notifications that closely resemble those from legitimate services such as banking portals, email providers, or system security alerts. When users interact with these spoofed elements under the assumption of legitimacy, they may inadvertently disclose sensitive credentials, click on malicious links, or download malware disguised as updates or required plugins. The severity is classified as low by Chromium because it does not allow for arbitrary code execution or sandbox escape; however, its effectiveness in phishing campaigns remains significant due to the high level of trust users typically place in browser-generated notifications and system-like interfaces.
This vulnerability aligns with CWE-201, which defines information exposure through an unintended disclosure of information via UI misrepresentation, as well as CWE-798, involving the use of hard-coded credentials or deceptive authentication mechanisms when combined with social engineering tactics. In terms of offensive security frameworks, this flaw facilitates techniques associated with MITRE ATT&CK ID T1566.002, known as Spearphishing Link, where attackers lure victims to malicious sites that exploit trust in familiar interfaces. It also touches upon T1078, Valid Accounts, if the spoofed UI is used to harvest credentials for legitimate services. The attack vector requires user interaction and social engineering success, meaning it does not operate autonomously but relies on manipulating human psychology rather than software logic errors alone.
Mitigation strategies focus heavily on timely patching and user education. Administrators should ensure that Google Chrome is updated to version 157.0.8103.38 or later, where the rendering engine has been corrected to prevent such UI spoofing. For end-users, awareness training regarding notification permissions is critical; users should be advised to scrutinize notifications from unknown sources and verify the URL bar for legitimate domains before interacting with any prompts. Additionally, enabling strict site isolation policies can help contain potential damage if a malicious page attempts further exploitation after initial social engineering success. While this specific vulnerability does not compromise browser integrity directly, it underscores the importance of maintaining up-to-date software to close gaps that facilitate sophisticated phishing and credential harvesting campaigns.