PULSE
ES
FEED
ransombooba project reclama a LifeFone · US · Healthcareransombooba project reclama a National Association of Credit Management · US · Financial Servicesransombooba project reclama a California School Boards Association · US · Educationransombooba project reclama a South Weber City · US · Government & Defenseransombooba project reclama a Programs for Parents, Inc. · US · Educationransombooba project reclama a Circleville Police Department · US · Government & Defenseransomemperador reclama a MAA Group Consulting Engineers · Professional Servicesransomrhysida reclama a ClaimTek Systems · Financial Servicesransomlockbit5 reclama a xspringcapital.com · SG · Financial Servicesransomlockbit5 reclama a susannecerda.com · MXransomanubis reclama a Santiam Hospital & Clinics · US · Healthcareransomsilentransomgroup reclama a Lowenstein Sandler LLP · US · Professional Servicesransompear reclama a Cyrious Software · US · Technologyransomwallstreet reclama a Fortrex · US · Manufacturingransombooba project reclama a LifeFone · US · Healthcareransombooba project reclama a National Association of Credit Management · US · Financial Servicesransombooba project reclama a California School Boards Association · US · Educationransombooba project reclama a South Weber City · US · Government & Defenseransombooba project reclama a Programs for Parents, Inc. · US · Educationransombooba project reclama a Circleville Police Department · US · Government & Defenseransomemperador reclama a MAA Group Consulting Engineers · Professional Servicesransomrhysida reclama a ClaimTek Systems · Financial Servicesransomlockbit5 reclama a xspringcapital.com · SG · Financial Servicesransomlockbit5 reclama a susannecerda.com · MXransomanubis reclama a Santiam Hospital & Clinics · US · Healthcareransomsilentransomgroup reclama a Lowenstein Sandler LLP · US · Professional Servicesransompear reclama a Cyrious Software · US · Technologyransomwallstreet reclama a Fortrex · US · Manufacturing
← All CVEs
CVE WatchJul 23, 2026

CVE-2026-11232

Inappropriate implementation in TabGroups in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via malic

CVSS

5.4

Medium

EPSS

0.1%

p4

KEV

—

Exploit Today

1

0-100

Published: Jun 4, 2026 · Last modified: Jul 23, 2026 · CWE-451

EPSS · 30d
0.1%EPSS · 30 days0.1%
2026-09-302026-10-28
Technical description

Inappropriate implementation in TabGroups in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via malicious network traffic. (Chromium security severity: Low)

Official references
Related CVEs
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1166325.4 MED
11.6%
——3A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentialy allowing it to display a phishing message inside system UI. This vulnerability was fixed in Firefox for iOS 156.1.2dCVE-2026-1166315.4 MED
11.6%
——3A malicious web page could open a tel link in a window that was showing a different website, causing the phone-call prompt to appear as if that site had requested the call. This vulnerability was fixed in Firefox for iOS 156.1.2dCVE-2026-1094344.3 MED
22.9%
——7Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofing vulnerability that allows remote attackers to impersonate the browser's trusted address bar by entering fullscreen mode via the Fullscreen API without displaying a persistent notification or trusted-origin indicator. Attackers can render a counterfeit address bar showing a trusted origin over attacker-controlled content after a single user tap, enabling credential harvesting, malware delivery, or social engineering through fake login, update, or payment pages.10dCVE-2026-1097477.3 HIG
20.7%
——6Other issue in the Address Bar component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.10dCVE-2026-1097368.1 HIG
25.3%
——8Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.10dCVE-2026-1093468.1 HIG
20.2%
——6better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id and scope. Attackers can start a device request via /device/code, trick signed-in users into approving the code, then redeem it at /device/token for a live session token.3d