PatchGap · Weakness Pattern
Security UI spoofable via occlusion late-binding timing or geometry
WP-UI-SPOOF
Spoofing
21 CVEs
21 mapped
CWE-1021CWE-451
2025-01 → 2026-09
Trusted security UI (origin display, permission prompt, fullscreen notice, download or file-access indicator) can be spoofed, occluded, mispositioned, or acted upon against the wrong target. Attacker-controlled content covers, outlives, mistimes, or geometrically displaces the UI, or the user’s action late-binds to a different request or page than the one the UI represented.
Invariant
Security UI must be visible, correctly positioned, and bound to the exact origin, request, and page it was created to represent for the entire window in which the user can act on it.
Mechanism
Members cluster into occlusion (dialogs never enrolled in SecurityDialogTracker, CVE-2025-0446; PiP or subpage buttons left clickable behind an overlay, CVE-2026-87655, CVE-2026-87507; emoji panel over fullscreen, CVE-2026-87653), late-binding (action bound to whatever request is active at click time rather than the cached request identity, CVE-2026-95294; a bubble re-resolving its page on demand after navigation, CVE-2026-87641, CVE-2026-87496; a credentials callback painting a password surface for an already-navigated frame, CVE-2026-87624), geometry (action bar placed over the omnibox, CVE-2025-1917; attacker string sizing window geometry, CVE-2026-95305; dialog dragged off-screen, CVE-2026-95346), and content spoofing (raw URL query/fragment in a trust label, CVE-2026-95307; unfiltered bidi/control chars in extension strings, CVE-2026-93386).
Fix shape
Pin the UI to a specific content::Page or cached request identity, close it on PrimaryPageChanged, drop fullscreen and enroll dialogs in occlusion tracking, and sanitize or bound any attacker-controlled string before display.
CVEs in this pattern
15 components · Browser, FullScreen, Downloads, Views, Chromoting, CustomTabs, Passwords, WebAppInstalls, ExtensionsMenu, Messages, FileSystem, WebApp Installs, Browser UI, Fullscreen, Extensions| CVE | What | Component | Vendor | Severity | Month | |
|---|---|---|---|---|---|---|
| CVE-2026-84330 | Spoofing in FullScree | FullScreen | chrome | Medium | 2026-09 | 🔧 |
| CVE-2026-87496 | Spoofing in Browser | Browser | chrome | Medium | 2026-09 | 🔧 |
| CVE-2026-87507 | Spoofing in Downloads | Downloads | chrome | Medium | 2026-09 | 🔧 |
| CVE-2026-87597 | Spoofing in CustomTabs | CustomTabs | chrome | Low | 2026-09 | 🔧 |
| CVE-2026-87616 | LogicError in Views | Views | chrome | Medium | 2026-09 | 🔧 |
| CVE-2026-87624 | Spoofing in Passwords | Passwords | chrome | Low | 2026-09 | 🔧 |
| CVE-2026-87641 | Race in Browser | Browser | chrome | Medium | 2026-09 | 🔧 |
| CVE-2026-87653 | Spoofing in FullScree | FullScreen | chrome | Low | 2026-09 | 🔧 |
| CVE-2026-87655 | LogicError in Downloads | Downloads | chrome | Medium | 2026-09 | 🔧 |
| CVE-2026-93386 | Spoofing in WebAppInstalls | WebAppInstalls | chrome | Low | 2026-09 | 🔧 |
| CVE-2026-95294 | Spoofing in Browser | Browser | chrome | Medium | 2026-09 | 🔧 |
| CVE-2026-95305 | Spoofing in Chromoting | Chromoting | chrome | Low | 2026-09 | 🔧 |
| CVE-2026-95307 | Spoofing in ExtensionsMenu | ExtensionsMenu | chrome | Low | 2026-09 | 🔧 |
| CVE-2026-95337 | Spoofing in Messages | Messages | chrome | Medium | 2026-09 | 🔧 |
| CVE-2026-95346 | Spoofing in Chromoting | Chromoting | chrome | Medium | 2026-09 | 🔧 |
| CVE-2026-95363 | Spoofing in FileSystem | FileSystem | chrome | Medium | 2026-09 | 🔧 |
| CVE-2026-95371 | AuthorizationError in Views | Views | chrome | Medium | 2026-09 | 🔧 |
| CVE-2025-13102 | LogicError in WebApp Installs | WebApp Installs | chrome | Low | 2025-03 | 🔧 |
| CVE-2025-1917 | LogicError in Browser UI | Browser UI | chrome | Medium | 2025-03 | 🔧 |
| CVE-2025-0440 | LogicError in Fullscree | Fullscreen | chrome | Medium | 2025-01 | 🔧 |
| CVE-2025-0446 | LogicError in Extensions | Extensions | chrome | Low | 2025-01 | 🔧 |
Hunt for siblings
Auditors should look for security UI whose confirming action resolves its target lazily at click time, whose lifetime spans a navigation, or whose geometry/content derives from attacker-controllable strings; occlusion fuzzing and navigation-race harnesses surface these directly.
Mitigations that would catch this class
- Bind each security surface to a cached request identity and a specific Page, and invalidate it on navigation (PrimaryPageChanged).
- Enroll all confirmation dialogs in occlusion tracking and disable every actionable control, not just a subset, while occluded.
- Sanitize attacker-controlled display strings (strip bidi/control chars, clear URL query/fragment) and bound label geometry so remote input cannot size or displace the UI.