CVE-2026-17998

Analyzed Analyzed - Analysis Complete

Incorrect Security UI in Google Chrome Extensions

Publication date: 2026-07-30

Last updated on: 2026-08-03

Assigner: Chrome

Description

Incorrect security UI in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-08-03

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-17998

EUVD

EUVD-2026-50924

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 151.0.7922.72 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-451	The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.

Attack-Flow Graph

Executive Summary

This vulnerability involves incorrect security UI in Google Chrome's Extensions feature. An attacker could trick a user into installing a malicious extension that then performs UI spoofing, making it appear as though the user is interacting with a legitimate Chrome interface when they are not.

Detection Guidance

This vulnerability involves UI spoofing in Google Chrome extensions due to incorrect security UI handling. To detect it, check installed extensions for suspicious or unfamiliar ones via chrome://extensions in Chrome. Look for extensions with unusual permissions or behavior. No specific commands are provided for detection in the given context.

Impact Analysis

This vulnerability could allow an attacker to deceive you into performing actions you did not intend by mimicking legitimate Chrome interfaces. For example, it might trick you into entering sensitive information or granting unnecessary permissions to a malicious extension.

Compliance Impact

This vulnerability involves UI spoofing in Chrome extensions, which could potentially mislead users into granting unnecessary permissions or installing malicious extensions. While it does not directly impact GDPR or HIPAA compliance, it could indirectly contribute to non-compliance by enabling phishing attacks or unauthorized data access if exploited.

Mitigation Strategies

Update Google Chrome to version 151.0.7922.72 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-17998. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70