CVE-2026-17755

Analyzed Analyzed - Analysis Complete

Incorrect Security UI in Chrome Extensions Allows UI Spoofing

Publication date: 2026-07-30

Last updated on: 2026-08-04

Assigner: Chrome

Description

Incorrect security UI in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-08-04

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-17755

EUVD

EUVD-2026-50705

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 151.0.7922.72 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-451	The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.

Attack-Flow Graph

Executive Summary

This vulnerability involves incorrect security UI in Google Chrome's Extensions feature. An attacker could trick a user into installing a malicious extension that then performs UI spoofing, potentially misleading the user about what actions the extension is taking.

Detection Guidance

This vulnerability involves UI spoofing in Google Chrome's Extensions due to incorrect security UI. Detection requires checking Chrome version and installed extensions. Verify Chrome version is 151.0.7922.72 or later. Inspect extensions for suspicious permissions or behavior.

Impact Analysis

If exploited, this vulnerability could allow an attacker to deceive you into thinking an extension is performing one action when it is actually doing something else, such as stealing data or installing additional malicious software.

Compliance Impact

This vulnerability involves UI spoofing in Chrome extensions, which could mislead users into granting excessive permissions to malicious extensions. This may lead to unauthorized data access or exposure, potentially violating GDPR (data protection) or HIPAA (health data privacy) compliance if sensitive user data is compromised.

Mitigation Strategies

Update Google Chrome to version 151.0.7922.72 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-17755. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70