CVE-2026-18018: Inappropriate implementation in Google Chrome
CVE-2026-18018 is a vulnerability in the Updater component of Google Chrome on Windows versions prior to 151.0.7922.72. It allows a local attacker to perform UI spoofing by leveraging a malicious file. The issue is classified with low security severity by Chromium and has a CVSS score of 4. No official remediation level or patch link is explicitly stated in the provided data, but a vendor advisory is available. The vulnerability does not impact confidentiality or integrity but may affect availability slightly. There are no known exploits in the wild.
AI Analysis
Technical Summary
This vulnerability involves an inappropriate implementation in the Updater of Google Chrome on Windows platforms before version 151.0.7922.72. It permits a local attacker to conduct UI spoofing attacks by using a malicious file. The CVE is tracked as CVE-2026-18018 and is associated with CWE-451 (Incorrect Expression of UI). The CVSS v3.1 base score is 4.0, reflecting low impact on confidentiality, integrity, and limited impact on availability. The vulnerability is local attack vector with low complexity and no privileges required. The vendor advisory is linked but does not explicitly confirm patch availability or remediation level.
Potential Impact
The vulnerability allows local attackers to perform UI spoofing, which could mislead users by displaying deceptive user interface elements. There is no impact on confidentiality or integrity, and only a low impact on availability is noted. No known active exploitation has been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for current remediation guidance. Since no explicit patch or remediation level is stated, users should monitor official Google Chrome release notes and update to version 151.0.7922.72 or later once confirmed.
CVE-2026-18018: Inappropriate implementation in Google Chrome
Description
CVE-2026-18018 is a vulnerability in the Updater component of Google Chrome on Windows versions prior to 151.0.7922.72. It allows a local attacker to perform UI spoofing by leveraging a malicious file. The issue is classified with low security severity by Chromium and has a CVSS score of 4. No official remediation level or patch link is explicitly stated in the provided data, but a vendor advisory is available. The vulnerability does not impact confidentiality or integrity but may affect availability slightly. There are no known exploits in the wild.
CVSS v3.1
Score 4.0medium
Affected software
Chrome
pkg:github/chromium/chromiumRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves an inappropriate implementation in the Updater of Google Chrome on Windows platforms before version 151.0.7922.72. It permits a local attacker to conduct UI spoofing attacks by using a malicious file. The CVE is tracked as CVE-2026-18018 and is associated with CWE-451 (Incorrect Expression of UI). The CVSS v3.1 base score is 4.0, reflecting low impact on confidentiality, integrity, and limited impact on availability. The vulnerability is local attack vector with low complexity and no privileges required. The vendor advisory is linked but does not explicitly confirm patch availability or remediation level.
Potential Impact
The vulnerability allows local attackers to perform UI spoofing, which could mislead users by displaying deceptive user interface elements. There is no impact on confidentiality or integrity, and only a low impact on availability is noted. No known active exploitation has been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for current remediation guidance. Since no explicit patch or remediation level is stated, users should monitor official Google Chrome release notes and update to version 151.0.7922.72 or later once confirmed.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Chrome
- Date Reserved
- 2026-07-27T23:37:19.318Z
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html","vendor":"Google"}]
Threat ID: 6a6aa0b39c2644c7f849c13c
Added to database: 07/30/2026, 00:54:11 UTC
Last enriched: 08/06/2026, 17:52:34 UTC
Last updated: 09/12/2026, 22:01:32 UTC
Views: 69
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.