CVE-2026-9110

MediumCVSS 4.2/10Last modified Jul 23, 2026

Description

Inappropriate implementation in UI in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Critical)

Metrics

CVSS 3.1 4.2/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-451

Affected software

No affected versions have been published.

Timeline

Published: May 20, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-911009.8HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components CVE-2026-911019.8HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components CVE-2026-911029.8HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components CVE-2026-911039.8HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components CVE-2026-911049.8HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components CVE-2026-911059.8HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components CVE-2026-911069.8HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components CVE-2026-911079.3openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and ca CVE-2026-911084.3The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to authorization bypass CVE-2026-911096.5The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including CVE-2026-91118.8Use after free in WebRTC in Google Chrome on Linux prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted CVE-2026-911196.4Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-acti