Security readout for executives and security teams
Plain-English summary
CVE-2026-0907 is a Chrome Split View UI spoofing issue fixed in Chrome 144.0.7559.59. A malicious web page could display misleading security UI, potentially tricking users about what site or security context they are seeing. Google rates the Chromium severity as Low, while the supplied CVSS data says Critical, so treat scoring as inconsistent.
Executive priority
Address through normal expedited browser patch management, not emergency response, unless your environment has delayed Chrome updates or high-value web workflows. The main business risk is user deception rather than direct system compromise based on the supplied public details.
Technical view
The CVE describes incorrect security UI in Google Chrome Split View before 144.0.7559.59, enabling UI spoofing via crafted HTML. The weakness maps to CWE-451. The public description does not show code execution, sandbox escape, or data theft by itself. Public evidence supplied does not confirm exploitation in the wild.
Likely exposure
Organizations with desktop Chrome versions prior to 144.0.7559.59 are potentially exposed. Risk is highest where users handle sensitive logins, payments, or approvals in Chrome and could be misled by spoofed browser security indicators.
Exploitation context
The cited CVE says exploitation is remote and uses a crafted HTML page. No public source in the bundle confirms active exploitation, and the CVE is not listed as KEV. The Chromium issue may contain restricted details, so public technical evidence is limited.
Researcher notes
There is a notable mismatch between supplied CVSS 9.8 Critical scoring and Google’s stated Chromium severity Low. Public details only support UI spoofing in Split View via crafted HTML. Avoid assuming memory corruption, arbitrary code execution, or confirmed exploitation without additional vendor disclosure.
Mitigation direction
- Update Google Chrome to 144.0.7559.59 or later per Google’s stable channel guidance.
- Ensure managed browser fleets enforce automatic updates and restart completion.
- Prioritize users handling finance, identity, administration, or sensitive approvals.
- Check Google’s Chrome release notes for any revised guidance.
Validation and detection
- Inventory Chrome desktop versions across managed endpoints.
- Confirm installed versions are 144.0.7559.59 or later.
- Verify browser update policies are enabled and reporting accurately.
- Review security awareness guidance for spoofed browser UI risks.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-451: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-0907 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
User Interface (UI) Misrepresentation of Critical Information
User Interface (UI) Misrepresentation of Critical Information represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.