CVE-2026-79204 in Chrome
Summary
by MITRE • 08/26/2026
UI misrepresentation in Input in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as a user interface misrepresentation issue within the Chromium engine, specifically affecting Google Chrome versions on macOS prior to 152.0.7977.65, represents a significant class of social engineering risks known as UI redressing or clickjacking variants. This flaw allows an attacker who hosts a malicious HTML page to manipulate how specific interface elements are rendered in the browser window relative to other content on the screen. By exploiting rendering inconsistencies or layout calculation errors inherent in the older version of the engine, the attacker can position deceptive overlays, fake buttons, or misleading text boxes directly over legitimate interactive components such as login fields, download prompts, or navigation links. This technique does not involve breaking out of the browser sandbox but rather abuses the visual layer to deceive the user into interacting with elements that appear to be part of a trusted site while actually triggering actions controlled by the malicious page.
From a technical perspective, this vulnerability falls under the category of UI redressing attacks where the integrity of the graphical user interface is compromised without violating same-origin policy restrictions in the traditional sense. The attacker crafts an HTML document containing carefully positioned elements using CSS properties such as absolute positioning or z-index manipulation to create visual illusions. When a victim visits the crafted page, their browser renders these elements in a way that obscures the true nature of the underlying controls. For instance, a user might believe they are clicking a legitimate button on a trusted website, but due to the misrepresentation, they are actually interacting with a hidden element from the attacker's domain or triggering an unintended action like downloading malware or submitting credentials to a phishing site. This exploits the trust users place in visual cues and familiar interface patterns rather than exploiting code execution flaws directly.
The operational impact of this vulnerability is primarily centered around user deception and subsequent credential theft or malicious software installation. Because the attack relies on social engineering tactics facilitated by technical rendering errors, it can bypass traditional security controls that focus solely on network-level threats or script injection prevention. Users who are not vigilant about verifying URL bars and certificate details may be tricked into entering sensitive information such as passwords, credit card numbers, or two-factor authentication codes into fake forms designed to look identical to legitimate services like banking portals or email providers. Furthermore, the ability to spoof UI elements can lead users to inadvertently grant permissions or install extensions by clicking on disguised download buttons that mimic system prompts or browser notifications, thereby compromising device security and privacy.
To mitigate this risk, it is imperative for organizations and individual users to upgrade Google Chrome immediately to version 152.0.7977.65 or later where these rendering inconsistencies have been addressed by the Chromium development team. Security administrators should enforce automatic update policies across all endpoints running macOS to ensure that patches are applied promptly upon release. Additionally, user education plays a critical role in defense against such attacks; users must be trained to verify the exact URL displayed in the address bar before entering any sensitive data and to remain skeptical of unexpected pop-ups or overlays that do not match standard browser behavior. While technical mitigations like Content Security Policy headers can help prevent some forms of injection, they are less effective against pure UI redressing attacks which rely on legitimate rendering capabilities abused for deceptive purposes. Therefore, keeping software up-to-date remains the most effective defense strategy against this class of vulnerabilities.
This incident aligns with Common Weakness Enumeration (CWE) categories related to user interface misrepresentation and is often associated with ATT&CK techniques involving social engineering and phishing campaigns where visual deception is used to harvest credentials or deliver malware. The medium severity rating assigned by Chromium reflects the balance between the ease of exploitation for an attacker skilled in web development and the potential harm caused if successful, emphasizing that while it does not allow direct code execution, its impact on data confidentiality and integrity can be severe through indirect means.