CVE-2026-95371 is a vulnerability in Google Chrome on Mac systems before version 154.0.8037.57. It involves missing authorization in Views, which enables a remote attacker with control over the renderer process to spoof user interface elements by crafting malicious HTML content. This can be exploited through social engineering to deceive users. The vulnerability has been publicly disclosed and addressed by Google in the stable channel update.

An attacker who has already compromised the renderer process can exploit this vulnerability to spoof UI elements, potentially misleading users into performing unintended actions. The impact is limited to UI spoofing and requires prior compromise of the renderer process and social engineering, thus rated medium severity.

Google has released a stable channel update for Chrome on Mac that fixes this vulnerability in version 154.0.8037.57. Users should update to this version or later to remediate the issue. No additional mitigation is required beyond applying the official update.