CVE-2026-3928 — User Interface (UI) Misrepresentation of Critical Information in Google Chrome

CWE-451 — User Interface (UI) Misrepresentation of Critical Information9 documents9 sources

Severity

4.3MEDIUMNVD

EPSS

0.0%

top 96.46%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Google Chrome Chromium

Timeline

PublishedMar 11

Latest updateMar 24

Description

Insufficient policy enforcement in Extensions in Google Chrome prior to 146.0.7680.71 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Medium)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages3 packages

▶CVEListV5google/chrome146.0.7680.71 — 146.0.7680.71

▶NVDgoogle/chrome< 146.0.7680.71

▶Debianchromium/chromium< 146.0.7680.71-1~deb12u1+2

🔴Vulnerability Details

GHSA

GHSA-7c9p-58x7-4wjx: Insufficient policy enforcement in Extensions in Google Chrome prior to 146↗2026-03-12

▶

OSV

CVE-2026-3928: Insufficient policy enforcement in Extensions in Google Chrome prior to 146↗2026-03-11

▶

CVEList

CVE-2026-3928: Insufficient policy enforcement in Extensions in Google Chrome prior to 146↗2026-03-11

▶

📋Vendor Advisories

Chrome

Stable Channel Update for ChromeOS / ChromeOS Flex: CVE-2026-3928↗2026-03-24

▶

Red Hat

chromium-browser: Insufficient policy enforcement in Extensions↗2026-03-10

▶

Microsoft

Chromium: CVE-2026-3928 Insufficient policy enforcement in Extensions↗2026-03-10

▶

Debian

CVE-2026-3928: chromium - Insufficient policy enforcement in Extensions in Google Chrome prior to 146.0.76...↗2026

▶

🕵️Threat Intelligence

Wiz

CVE-2026-3928 Impact, Exploitability, and Mitigation Steps | Wiz↗

▶