CVE-2026-121190 in Chrome
Summary
by MITRE • 11/03/2026
UI misrepresentation in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Low)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified as a user interface misrepresentation within the Extensions subsystem of Google Chrome prior to version 157.0.8103.38 represents a significant trust boundary violation that exploits the inherent reliance users place on browser UI elements for authentication and authorization decisions. This flaw allows an attacker, typically through social engineering tactics such as phishing or malicious extension distribution, to manipulate the visual presentation of interface components associated with Chrome extensions. By crafting a specific extension payload, the adversary can alter how permissions are displayed, hide critical warning indicators, or mimic legitimate system dialogs, thereby deceiving the end-user into granting elevated privileges or executing unintended actions under false pretenses. The Chromium project has classified this issue with a Low security severity rating, reflecting that while it does not directly compromise browser internals via memory corruption or code execution, it fundamentally undermines the integrity of the user interface which serves as the primary defense mechanism against unauthorized access and data exfiltration.
From a technical perspective, this vulnerability stems from insufficient validation or sanitization of extension manifest properties and UI rendering logic within the extensions framework. When an extension is installed or active, Chrome renders various prompts to inform users about requested permissions such as access to browsing history, clipboard content, or network requests. The flaw enables these rendered elements to be spoofed, meaning the text, icons, or layout presented to the user can differ significantly from what the underlying code actually intends to convey. This discrepancy creates a cognitive gap where the user perceives one level of risk while the extension operates with another. For instance, an attacker might craft an extension that appears to request only read-only access to tabs but visually mimics a prompt requesting full control over all websites, leading users to inadvertently authorize broad permissions.
The operational impact of this vulnerability is primarily centered on social engineering success rates and subsequent data compromise. Although the severity is rated as low because it does not allow for direct remote code execution or sandbox escape, its effectiveness in real-world attacks can be substantial due to human factors. Attackers leverage this UI spoofing to bypass user vigilance, which is often the last line of defense against malicious software. Once users are deceived into granting permissions based on misleading interface elements, the extension can proceed to exfiltrate sensitive data such as login credentials, financial information, or private communications without further interaction from the victim. This type of attack aligns with the MITRE ATT&CK framework technique T1566.002, which involves Spearphishing Attachment, and more specifically relates to UI redressing attacks where attackers deceive users into interacting with malicious elements disguised as legitimate ones.
To mitigate this risk, organizations and individual users must ensure that Google Chrome is updated to version 157.0.8103.38 or later, which contains the necessary patches for these extensions subsystem flaws. Beyond software updates, security awareness training should emphasize skepticism toward unexpected permission requests, even those that appear familiar in layout but may contain subtle discrepancies in wording or iconography. Users are advised to carefully review the full list of permissions requested by any extension before installation and to prefer extensions from verified publishers with high ratings and transparent privacy policies. Additionally, deploying browser security tools that monitor for unusual UI behavior or permission escalation patterns can provide an additional layer of defense against such social engineering exploits. The underlying principle here is that while technical controls are vital, the integrity of the user interface remains critical for maintaining accurate threat perception and preventing unauthorized privilege elevation through deception.