{"id":"CVE-2026-121206","kind":"vulnerability","aliases":["CVE-2026-121206"],"related":[],"title":"Chrome: crafted page could spoof browser UI elements via social engineering","description":"UI misrepresentation in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","summary":"A UI misrepresentation flaw in the Isolated component of Google Chrome before 157.0.8103.38 lets a remote attacker spoof interface elements using a crafted HTML page. The attack depends on social engineering to get a user to visit the page, and the Chromium security severity is rated Low.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","chrome","desktop","runtime"],"not_affected_if":["chrome-updated","non-chrome-browser"],"how_to_check":"- Check the installed Chrome version (Help > About Google Chrome) and compare it to `157.0.8103.38`.","fix":"- Google Chrome: move to `157.0.8103.38` or later.","status":"open","published_at":"2026-11-03T21:17:29+00:00","first_seen_at":"2026-11-03T21:19:26+00:00","triaged_at":"2026-11-03T21:22:45+00:00","updated_at":"2026-11-03T21:22:45+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-03T21:22:45Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome: move to `157.0.8103.38` or later.","reach":"internet","title":"Chrome: crafted page could spoof browser UI elements via social engineering","impact":"low","summary":"A UI misrepresentation flaw in the Isolated component of Google Chrome before 157.0.8103.38 lets a remote attacker spoof interface elements using a crafted HTML page. The attack depends on social engineering to get a user to visit the page, and the Chromium security severity is rated Low.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["chrome","browser","desktop"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"spoofed browser UI could mislead a user into trusting a fake prompt","analyst_note":"","how_to_check":"- Check the installed Chrome version (Help > About Google Chrome) and compare it to `157.0.8103.38`.\n- unknown","plain_action":"Update Google Chrome to version 157.0.8103.38 or later through its built-in update check.","needs_analyst":false,"not_affected_if":["chrome-updated","non-chrome-browser"],"who_is_affected":"Anyone running Google Chrome before 157.0.8103.38 on a desktop or laptop is exposed, since the flaw is in the browser itself. Managed fleets that pin Chrome versions should confirm they receive the update. Users who do not visit untrusted pages are at lower risk.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000684,"input_tokens":4108,"output_tokens":546,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121206':14A,17A '-2026':13A,16A '157.0.8103.38':34B,78C 'allow':79C 'attack':38B,48B,82C 'browser':6A,18B 'chrome':1A,19B,32B,75C 'chromium':63B,95C 'compon':29B 'could':4A 'craft':2A,44B,92C 'cve':12A,15A 'depend':49B 'desktop':20B 'element':8A,41B,89C 'engin':11A,52B,85C 'flaw':25B 'get':54B 'googl':31B,74C 'html':45B,93C 'interfac':40B 'isol':28B,72C 'let':35B 'leverag':83C 'low':68B,98C 'misrepresent':24B,70C 'page':3A,46B,60B,94C 'prior':76C 'rate':67B 'remot':37B,81C 'runtim':21B 'secur':64B,96C 'sever':65B,97C 'social':10A,51B,84C 'spoof':5A,39B,87C 'ui':7A,23B,69C,88C 'use':42B 'user':56B 'via':9A,90C 'visit':58B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Google Chrome before 157.0.8103.38 on a desktop or laptop is exposed, since the flaw is in the browser itself. Managed fleets that pin Chrome versions should confirm they receive the update. Users who do not visit untrusted pages are at lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Google Chrome to version 157.0.8103.38 or later through its built-in update check.","pkeys":[],"ptokens":[],"labels":["browser","chrome","desktop","low","runtime"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121206","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121206","severity":null,"published_at":"2026-11-03T21:17:29+00:00","modified_at":"2026-11-03T21:17:29+00:00","first_seen_at":"2026-11-03T21:19:26+00:00","fetched_at":"2026-11-03T21:19:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}