CVE-2026-106311
Clickjacking in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof U
CVSS
—
No CVSS
EPSS
0.2%
p8
KEV
—
Exploit Today
2
0-100
Published: Oct 6, 2026 · Last modified: Oct 6, 2026 · CWE-1021
0.2%EPSS · 30 days0.2%
2026-10-072026-10-19
Clickjacking in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-600083.5 LOW29.5%
——9Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabling sanitization and rendering directly in the main document without an iframe sandbox. A malicious repository notebook can supply multiple CSS classes that create a viewport-covering overlay and intercept clicks when another user views it. The reported impact is UI redress; script execution was not demonstrated.6dCVE-2026-1089013.5 LOW18.1%
——5A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability is an unknown functionality of the component Display QR Code Rendering. Performing a manipulation of the argument alignment results in improper restriction of rendered ui layers. The attack can only be performed from the local network. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.7dCVE-2026-106400—8.2%
——2Clickjacking in Messages in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)14dCVE-2026-1063565.4 MED14.8%
——4Clickjacking in EVP in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)6dCVE-2026-711775.4 MED2.8%
——1Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Rendered UI Layers or Frames vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges and Session theft.25dCVE-2026-843889.6 CRI30.2%
——9A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions, FortiPAM Chrome Extension 7.4 all versions may allow attacker to information disclosure via remote unauthenticated attack24d