CVE-2026-16422

Analyzed Analyzed - Analysis Complete

Insufficient Input Validation in Google Chrome Certificate on Linux

Publication date: 2026-07-21

Last updated on: 2026-07-24

Assigner: Chrome

Description

Insufficient validation of untrusted input in Certificate in Google Chrome on Linux prior to 150.0.7871.182 allowed an attacker in a privileged network position to perform domain spoofing via malicious network traffic. (Chromium security severity: High)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-24

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-16422

EUVD

EUVD-2026-47575

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 150.0.7871.182 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability involves insufficient validation of untrusted input in Google Chrome's Certificate on Linux. An attacker in a privileged network position could exploit this to perform domain spoofing by sending malicious network traffic.

Detection Guidance

This vulnerability involves insufficient validation in Chrome's Certificate handling on Linux. Detection primarily requires verifying Chrome version and checking for unusual network traffic patterns. Update Chrome to version 150.0.7871.182 or later to patch the issue. Monitor network traffic for domain spoofing attempts, especially TLS/SSL handshake anomalies.

Impact Analysis

An attacker could trick you into visiting a fake website that appears legitimate, potentially leading to stolen credentials, data breaches, or malware installation. This is especially risky if you handle sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or health data, violating GDPR or HIPAA requirements for data protection and confidentiality. Organizations may face fines or legal consequences if exploited.

Mitigation Strategies

Update Google Chrome on Linux to version 150.0.7871.182 or later to address the insufficient input validation flaw.

Hi! I’m here to help you understand CVE-2026-16422. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70