CVE-2026-8006
Insufficient Policy Enforcement in DevTools in Google Chrome
Publication date: 2026-05-06
Last updated on: 2026-05-07
Assigner: Chrome
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| chrome | to 148.0.7778.96 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-451 | The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability involves insufficient policy enforcement in Google Chrome DevTools that allows UI spoofing via a malicious extension. Given its nature and the low severity rating, it primarily poses a risk of user deception rather than direct data breach or data loss.
There is no explicit information indicating that this vulnerability directly impacts compliance with common standards and regulations such as GDPR or HIPAA.
However, if exploited, UI spoofing could potentially be used as part of a social engineering attack to trick users into disclosing sensitive information, which might indirectly affect compliance depending on the context and data involved.
Can you explain this vulnerability to me?
This vulnerability is an insufficient policy enforcement issue in the DevTools component of Google Chrome versions prior to 148.0.7778.96. It allows an attacker who convinces a user to install a malicious Chrome extension to perform UI spoofing by using a specially crafted extension.
How can this vulnerability impact me? :
If exploited, this vulnerability can lead to UI spoofing, where the attacker can manipulate the browser's user interface to deceive the user. This could potentially trick users into performing unintended actions or disclosing sensitive information by presenting fake or misleading UI elements.