CVE-2026-2318

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2318", "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "state": "PUBLISHED", "assignerShortName": "Chrome", "dateReserved": "2026-02-10T21:51:44.856Z", "datePublished": "2026-02-11T18:08:03.785Z", "dateUpdated": "2026-02-12T15:35:56.235Z"}, "containers": {"cna": {"affected": [{"vendor": "Google", "product": "Chrome", "versions": [{"version": "145.0.7632.45", "status": "affected", "lessThan": "145.0.7632.45", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Inappropriate implementation in PictureInPicture in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Inappropriate implementation"}]}], "providerMetadata": {"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome", "dateUpdated": "2026-02-11T18:08:03.785Z"}, "references": [{"url": "https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_10.html"}, {"url": "https://issues.chromium.org/issues/363930141"}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-451", "lang": "en", "description": "CWE-451 User Interface (UI) Misrepresentation of Critical Information"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-02-12T15:35:23.501638Z", "id": "CVE-2026-2318", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-12T15:35:56.235Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-2318", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-12T15:35:23.501638Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-451", "description": "CWE-451 User Interface (UI) Misrepresentation of Critical Information"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-12T15:35:03.950Z"}}], "cna": {"affected": [{"vendor": "Google", "product": "Chrome", "versions": [{"status": "affected", "version": "145.0.7632.45", "lessThan": "145.0.7632.45", "versionType": "custom"}]}], "references": [{"url": "https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_10.html"}, {"url": "https://issues.chromium.org/issues/363930141"}], "descriptions": [{"lang": "en", "value": "Inappropriate implementation in PictureInPicture in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Inappropriate implementation"}]}], "providerMetadata": {"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome", "dateUpdated": "2026-02-11T18:08:03.785Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2318", "state": "PUBLISHED", "dateUpdated": "2026-02-12T15:35:56.235Z", "dateReserved": "2026-02-10T21:51:44.856Z", "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "datePublished": "2026-02-11T18:08:03.785Z", "assignerShortName": "Chrome"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Chrome", "vendor": "Google", "versions": [{"lessThan": "145.0.7632.45", "status": "affected", "version": "145.0.7632.45", "versionType": "custom"}]}], "source": "chrome-cve-admin@google.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "matchCriteriaId": "51821EAE-B89B-44D2-80B6-F868FC2B41B1", "versionEndExcluding": "145.0.7632.45", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E", "vulnerable": false}, {"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Inappropriate implementation in PictureInPicture in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)"}, {"lang": "es", "value": "Implementaci\u00f3n inapropiada en PictureInPicture en Google Chrome anterior a 145.0.7632.45 permiti\u00f3 a un atacante remoto que convenci\u00f3 a un usuario de realizar gestos espec\u00edficos de la interfaz de usuario, realizar suplantaci\u00f3n de interfaz de usuario a trav\u00e9s de una p\u00e1gina HTML manipulada. (Gravedad de seguridad de Chromium: Media)"}], "id": "CVE-2026-2318", "lastModified": "2026-06-17T10:30:46.420", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2318", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-12T15:35:23.501638Z", "version": "2.0.3"}}]}, "published": "2026-02-11T19:15:51.920", "references": [{"source": "chrome-cve-admin@google.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_10.html"}, {"source": "chrome-cve-admin@google.com", "tags": ["Permissions Required"], "url": "https://issues.chromium.org/issues/363930141"}], "sourceIdentifier": "chrome-cve-admin@google.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-451"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "chromium-browser: Inappropriate implementation in PictureInPicture", "id": "2439067", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439067"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2026-2318", "public_date": "2026-02-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-2318\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-2318\nhttps://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_10.html\nhttps://issues.chromium.org/issues/363930141"], "statement": "Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[145.0.7632.45,145.0.7632.45)"}}], "product": "chrome", "vendor": "google"}], "analysis": {"en": {"generated_at": "2026-04-17T20:16:07.751429+00:00", "value": {"mitigation_remediation": ["Update Google Chrome to version 145.0.7632.45 or later.", "Enable Chrome\u2019s auto\u2011update feature to receive future security patches automatically.", "Restrict or disable Picture\u2011in\u2011Picture mode via Chrome policy or flags if the feature is not required in your environment."], "summary": {"action": "Patch", "impact": "User Interface Spoofing"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Google Chrome versions older than 145.0.7632.45 on all major operating systems, including macOS, Linux, and Windows. As the Picture\u2011in\u2011Picture mode operates across platforms, the threat is applicable to every user running an impacted Chrome build regardless of OS.", "description_and_impact": "Inappropriate implementation of the Picture\u2011in\u2011Picture feature in Google Chrome allowed a remote attacker to persuade a user to perform specific interface gestures that result in UI spoofing. By loading a crafted HTML page, the attacker can overlay deceptive elements or misleading controls that trick the user into believing they are interacting with legitimate content. This flaw is classified as CWE\u2011451 and can lead to phishing or other social\u2011engineering attacks.", "risk_and_exploitability": "Severity is medium with a CVSS score of 6.5 and an EPSS probability of less than 1\u202f%, indicating a relatively low chance of exploitation at this time, and it is not listed in CISA\u2019s KEV catalog. Exploitation requires a malicious web page that induces the user to perform UI gestures; the attack is user\u2011initiated and relies on social engineering. The most likely vector is a compromised or malicious website that prompts the user to engage with Picture\u2011in\u2011Picture controls."}}}}, "created": "2026-02-11T21:37:39.045109+00:00", "updated": "2026-04-17T20:30:15.801552+00:00", "vendors": ["google", "google$PRODUCT$chrome"]}