CVE-2026-106302: UI misrepresentation in Google Chrome

CVE-2026-106302 is a vulnerability in Google Chrome's PermissionElement UI component affecting versions before 155.0.8059.39. It enables remote attackers to craft HTML pages that spoof UI elements, causing UI misrepresentation. This could be exploited through social engineering to deceive users. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity. No known exploits are reported in the wild. The vendor has published an advisory indicating a stable channel update addressing this issue.

The vulnerability allows remote attackers to misrepresent UI elements in Chrome, potentially tricking users into unintended actions due to spoofed interface components. The impact is limited to UI spoofing with no direct confidentiality or integrity compromise but includes limited availability impact. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, low confidentiality impact, no integrity impact, and low availability impact.

A fix is available in Google Chrome version 155.0.8059.39. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html for detailed update instructions.