Home / CVEs
CVE Database
Published vulnerabilities with severity, known exploitation and official sources.
CVE-2026-102314
Medium · 5.4
CWE-451 Sep 29, 2026
UI misrepresentation in TabStrip in Google Chrome prior to 154.0.8037.92 allowed a…
UI misrepresentation in TabStrip in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-102312
Medium · 4.3
CWE-451 Sep 29, 2026
UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.92…
UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: High)
CVE-2026-102305
Medium · 5.4
CWE-451 Sep 29, 2026
UI misrepresentation in SignIn in Google Chrome on on iOS prior to 154.0.8037.92 allowed…
UI misrepresentation in SignIn in Google Chrome on on iOS prior to 154.0.8037.92 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95363
Medium · 5.4
CWE-451 Sep 29, 2026
UI misrepresentation in FileSystem in Google Chrome prior to 154.0.8037.57 allowed a…
UI misrepresentation in FileSystem in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95346
Medium · 4.8
CWE-451 Sep 29, 2026
UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allowed a…
UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via crafted network traffic. (Chromium security severity: Medium)
CVE-2026-95337
Medium · 5.4
CWE-451 Sep 29, 2026
UI misrepresentation in Messages in Google Chrome on on Android prior to 154.0.8037.57…
UI misrepresentation in Messages in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95323
Medium · 5.4
CWE-451 Sep 29, 2026
UI misrepresentation in Chromium in Google Chrome on on iOS prior to 154.0.8037.57…
UI misrepresentation in Chromium in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95321
Medium · 5.4
CWE-451 Sep 29, 2026
UI misrepresentation in Payments in Google Chrome on on Android prior to 154.0.8037.57…
UI misrepresentation in Payments in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95309
Medium · 5.4
CWE-451 Sep 29, 2026
UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed…
UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95307
Medium · 5.4
CWE-451 Sep 29, 2026
UI misrepresentation in ExtensionsMenu in Google Chrome prior to 154.0.8037.57 allowed a…
UI misrepresentation in ExtensionsMenu in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95305
Medium · 4.8
CWE-451 Sep 29, 2026
UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allowed a…
UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low)
CVE-2026-95294
Medium · 5.4
CWE-451 Sep 29, 2026
UI misrepresentation in Browser in Google Chrome prior to 154.0.8037.57 allowed a remote…
UI misrepresentation in Browser in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95291
Medium · 5.4
CWE-451 Sep 29, 2026
UI misrepresentation in SecurityIndicators in Google Chrome on on iOS prior to…
UI misrepresentation in SecurityIndicators in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: High)
CVE-2026-95288
Medium · 5.4
CWE-451 Sep 29, 2026
UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed…
UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95279
Medium · 5.4
CWE-451 Sep 29, 2026
UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.57…
UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-100823
Medium · 5.4
CWE-451 Sep 29, 2026
Spoofing issue in the Downloads component in Firefox for Android
Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 157.
CVE-2026-100822
Medium · 5.4
CWE-451 Sep 29, 2026
Spoofing issue in the Networking: HTTP component
Spoofing issue in the Networking: HTTP component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
CVE-2026-94183
High · 7.4
CWE-451 Sep 23, 2026
Address bar spoofing risk in affected Android versions of Arc Search
Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is running in the background. A remote attacker can exploit this via a specially crafted website to render fake UI elements, such as a spoofed address bar, misleading the user about the origin of displayed content and increasing the risk of phishing.
CVE-2026-94181
High · 7.4
CWE-451 Sep 23, 2026
Address Bar Spoof Risk; Missing Fullscreen Notification via Select Element
An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers requestFullscreen without displaying the fullscreen notification.
CVE-2026-93386
Medium · 5.4
CWE-451 Sep 17, 2026
UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a…
UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-92069
Medium · 5.4
CWE-451 Sep 15, 2026
Spoofing issue in the DOM: Navigation component
Spoofing issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
CVE-2026-87653
Medium · 5.4
CWE-451 Sep 8, 2026
UI misrepresentation in FullScreen in Google Chrome on on Windows prior to 153.0.8010.36…
UI misrepresentation in FullScreen in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-87649
Medium · 5.4
CWE-451 Sep 8, 2026
UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowed a…
UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-87635
Medium · 5.4
CWE-451 Sep 8, 2026
UI misrepresentation in Payments in Google Chrome prior to 153.0.8010.36 allowed a…
UI misrepresentation in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-87624
Medium · 4.2
CWE-451 Sep 8, 2026
UI misrepresentation in Passwords in Google Chrome on on Android prior to 153.0.8010.36…
UI misrepresentation in Passwords in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)