CVE Intelligence
Analysis AI-assisted

CVE-2026-0907: Google Chrome Split View UI spoofing vulnerability

CVE-2026-0907 is an incorrect security UI issue in Split View in Google Chrome that allows a remote attacker to spoof the user interface through a crafted HTML page. The record gives a CVSS 3.1 base score of 9.8 from the CNA and CISA-ADP, while Chromium rates its security severity as Low. No confirmed exploitation appears in the sources consulted, and the record does not list a fixed version, so the vendor release notes should be checked.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-0907 affects the Split View feature of Google Chrome. According to the record, incorrect security UI handling allowed a remote attacker to perform UI spoofing through a crafted HTML page. The Chromium project rates the security severity as Low, while the CVSS 3.1 base score supplied by the CNA and CISA-ADP is 9.8. The vendor reference for the stable channel update is Chrome stable channel update.

Impact

  • The record describes UI spoofing, meaning a page may display misleading interface content to the user.
  • The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H rates confidentiality, integrity and availability impact as high. The record does not explain how UI spoofing leads to those impacts, so this reasoning is an inference.
  • The SSVC data lists technical impact as total and automatable as yes.

Affected products and versions

  • Google Chrome versions before 144.0.7559.59 are described as affected.
  • The affected data also lists 144.0.7559.60 and an entry described as a range starting at 144.0.7559.59 and ending at 144.0.7559.59. These entries are inconsistent, and the record does not clarify them.
  • No fixed versions are listed in the record. A missing entry does not mean no fix exists; the vendor release notes should be checked.

Exploitation status

  • The record shows this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
  • No confirmed exploitation appears in the sources consulted.
  • The SSVC exploitation field is none. The EPSS probability is 0.08815 with a percentile of 0.95186, but the EPSS date (2026-10-23) is later than the publication date, so its reliability should be verified.

Remediation and mitigation

  • Update Google Chrome to a build later than 144.0.7559.59 using the vendor channels, and confirm the build against the stable channel release notes.
  • Until updates are applied, limit browsing of untrusted pages and be cautious with unexpected prompts or interface content.
  • Use managed update policies to confirm that all desktop installations receive the update.

Detection guidance

  • Inventory Chrome installations and record their versions, flagging any build before 144.0.7559.59.
  • Review endpoint management data for browsers that have not restarted after an update, since an update may be staged but not active.
  • Treat unexpected browser UI behavior reported by users as a prompt for review, without relying on a specific signature.

Limitations of the available information

  • The record does not provide a CWE name for CWE-451 and gives no technical details of the flaw.
  • The Chromium issue tracker entry is marked as requiring permissions, so its details may not be accessible.
  • The fixed version is not stated directly in the record and must be confirmed with the vendor.
  • The affected version entries contain an inconsistency that the record does not resolve.

Frequently asked questions

What does CVE-2026-0907 allow an attacker to do?

According to the record, a remote attacker can perform UI spoofing in Google Chrome Split View by using a crafted HTML page. The record does not describe the technical details of the flaw.

Which Chrome versions are affected?

The description says versions before 144.0.7559.59 are affected. The affected data also contains an inconsistent entry for 144.0.7559.60, so the vendor release notes should be checked.

Is this vulnerability known to be exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.