CVE-2026-106316

Analyzed Analyzed - Analysis Complete

Remote UI Spoofing in Google Chrome on Mac

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: Chrome

Description

UI misrepresentation in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106316

EUVD

EUVD-2026-93642

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 155.0.8059.39 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-451	The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.

Attack-Flow Graph

Executive Summary

This vulnerability involves a UI misrepresentation issue in Chromoting within Google Chrome on Mac systems before version 155.0.8059.39. A remote attacker could exploit this by sending crafted network traffic to trick users into believing false UI elements, potentially leading to social engineering attacks.

Detection Guidance

This vulnerability involves UI misrepresentation in Chromoting for Google Chrome on Mac. Detection primarily requires checking the installed Chrome version. Run 'google-chrome --version' to verify if it is below 155.0.8059.39. If so, update Chrome immediately.

Impact Analysis

This vulnerability could allow an attacker to deceive you into interacting with fake UI elements, such as misleading dialog boxes or buttons. This might trick you into performing unintended actions, like entering sensitive information or granting permissions to malicious software.

Compliance Impact

This vulnerability involves UI misrepresentation in Google Chrome, which could be exploited via social engineering to deceive users. While it may not directly violate GDPR or HIPAA, it could contribute to phishing attacks that compromise user data or credentials, indirectly impacting compliance by increasing the risk of unauthorized access or data breaches.

Mitigation Strategies

Update Google Chrome to version 155.0.8059.39 or later to address the UI misrepresentation vulnerability.

Hi! I’m here to help you understand CVE-2026-106316. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70