CVE-2026-106232: UI misrepresentation in Google Chrome

This vulnerability involves UI misrepresentation in Google Chrome versions before 155.0.8059.39. An attacker can exploit this flaw remotely by crafting a specially designed HTML page that spoofs browser UI elements, potentially misleading users. The issue relies on social engineering to deceive users into interacting with the spoofed interface. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, low confidentiality impact, no integrity impact, and low availability impact.

The impact is limited to UI spoofing that may mislead users into believing they are interacting with legitimate browser elements. This could facilitate phishing or other social engineering attacks but does not directly compromise confidentiality or integrity of data. There is no indication of active exploitation in the wild.

A fix is available in Google Chrome version 155.0.8059.39. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html for detailed update instructions.