{"id":"CVE-2026-121190","kind":"vulnerability","aliases":["CVE-2026-121190"],"related":[],"title":"Chrome: crafted extension can spoof browser UI elements","description":"UI misrepresentation in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Low)","summary":"A crafted Chrome extension can display fake user interface elements, such as misleading prompts, in Google Chrome versions before 157.0.8103.38. A remote attacker who tricks a user into installing or using the extension can use the spoofed UI to deceive them.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","chrome","extensions","linux","macos","runtime","windows"],"not_affected_if":["current-chrome-version","no-extensions-installed"],"how_to_check":"- Check the Chrome version under Settings > About Chrome; versions below `157.0.8103.38` are in scope.\n- Review installed extensions at `chrome://extensions` and remove any unfamiliar ones.","fix":"- Google Chrome: move to `157.0.8103.38` or later.","status":"open","published_at":"2026-11-03T21:17:27+00:00","first_seen_at":"2026-11-03T21:19:25+00:00","triaged_at":"2026-11-03T21:22:59+00:00","updated_at":"2026-11-03T21:22:59+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-03T21:22:59Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome: move to `157.0.8103.38` or later.","reach":"internet","title":"Chrome: crafted extension can spoof browser UI elements","impact":"low","summary":"A crafted Chrome extension can display fake user interface elements, such as misleading prompts, in Google Chrome versions before 157.0.8103.38. A remote attacker who tricks a user into installing or using the extension can use the spoofed UI to deceive them.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["chrome","browser","extensions","windows","macos","linux"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Users are misled by spoofed browser interface elements","analyst_note":"","how_to_check":"- Check the Chrome version under Settings > About Chrome; versions below `157.0.8103.38` are in scope.\n- Review installed extensions at `chrome://extensions` and remove any unfamiliar ones.","plain_action":"Update Google Chrome to version 157.0.8103.38 or later, and remove any extensions you do not recognise.","needs_analyst":false,"not_affected_if":["current-chrome-version","no-extensions-installed"],"who_is_affected":"Anyone running Google Chrome before 157.0.8103.38 who has extensions installed or can be persuaded to install one. Managed fleets should check the Chrome version across endpoints. Users on current Chrome builds or without extensions are not exposed.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000685,"input_tokens":4109,"output_tokens":549,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121190':11A,14A '-2026':10A,13A '157.0.8103.38':41B,71C 'allow':72C 'attack':44B,75C 'browser':6A,15B 'chrome':1A,16B,24B,38B,68C,86C 'chromium':88C 'craft':2A,23B,85C 'cve':9A,12A 'deceiv':61B 'display':27B 'element':8A,31B,82C 'engin':78C 'extens':3A,17B,25B,54B,65C,87C 'fake':28B 'googl':37B,67C 'instal':50B 'interfac':30B 'leverag':76C 'linux':18B 'low':91C 'maco':19B 'mislead':34B 'misrepresent':63C 'prior':69C 'prompt':35B 'remot':43B,74C 'runtim':20B 'secur':89C 'sever':90C 'social':77C 'spoof':5A,58B,80C 'trick':46B 'ui':7A,59B,62C,81C 'use':52B,56B 'user':29B,48B 'version':39B 'via':83C 'window':21B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Google Chrome before 157.0.8103.38 who has extensions installed or can be persuaded to install one. Managed fleets should check the Chrome version across endpoints. Users on current Chrome builds or without extensions are not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Google Chrome to version 157.0.8103.38 or later, and remove any extensions you do not recognise.","pkeys":[],"ptokens":[],"labels":["browser","chrome","extensions","linux","low","macos","runtime","windows"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121190","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121190","severity":null,"published_at":"2026-11-03T21:17:27+00:00","modified_at":"2026-11-03T21:17:27+00:00","first_seen_at":"2026-11-03T21:19:25+00:00","fetched_at":"2026-11-03T21:19:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}