CVE-2026-11227: Chrome Tab Hover Card Domain Spoofing Vulnerability

Technical summary

CVE-2026-11227 exploits a user interface rendering flaw in Chrome's tab hover card implementation. The vulnerability stems from improper validation or sanitization of domain names displayed in the hover card UI element, allowing a remote attacker to craft a malicious domain that visually spoofs a legitimate domain when the hover card is rendered. The root cause is classified as CWE-451 (User Interface (UI) Misrepresentation of Critical Information), indicating that the security-critical domain information is being misrepresented to the user. The attack vector is network-based and does not require authentication or special privileges, though it does depend on user interaction. Chromium security classified this as Low severity; however, the CVSS v3.1 score of 6.5 (Medium) reflects the integrity impact of successful domain spoofing attacks.

Business impact

Domain spoofing attacks enabled by this flaw can compromise user trust in browser security indicators. Users relying on the tab hover card to verify they are on the correct domain could be socially engineered into entering credentials, payment information, or sensitive data on attacker-controlled sites. For organizations, this means employees using unpatched Chrome could be more vulnerable to phishing and credential harvesting campaigns that leverage visual deception. The impact is primarily reputational and information-disclosure related rather than system compromise, but can facilitate downstream attacks like unauthorized access or fraud.

Affected systems

The vulnerability affects Google Chrome on Windows, macOS, and Linux systems running versions prior to 149.0.7827.53. While the CVE entry lists broad platform categories (Windows, macOS, Linux kernel), the actual vulnerable component is the Chrome browser itself. Any user or organization running Chrome before version 149.0.7827.53 on any supported platform is at risk. Users should verify their current Chrome version and check for automatic updates.

Exploitability

Exploitation requires a remote attacker to craft and host a malicious domain with a name designed to visually spoof a legitimate domain within the tab hover card display. The attacker then must trick a user into clicking a link to that domain. Once the tab is open and the user hovers over it, the spoofed domain name will appear in the hover card, deceiving the user about the actual site they are visiting. The attack is relatively straightforward to execute but depends entirely on successful social engineering and user inattention. No special tools, exploits, or elevated privileges are required beyond hosting the malicious domain and delivering the link.

Remediation

Users and administrators should update Google Chrome to version 149.0.7827.53 or later. Chrome typically updates automatically, but users can manually check for updates via the menu (three dots) → Help → About Google Chrome. Organizations can enforce Chrome updates through mobile device management (MDM) solutions or group policy on managed endpoints. As an interim mitigation, users should exercise caution when hovering over tabs and verify the full URL in the address bar—not the tab hover card—before entering sensitive information. Educating users to trust the address bar over UI elements can reduce the window of vulnerability.

Patch guidance

Update Chrome to version 149.0.7827.53 or later. Verify the update using Chrome's About page, which will show the current version number. For enterprise deployments, consult Google's Chrome release notes and your organization's patch management procedures. Chromium-based browsers and forks may or may not receive the same patch; verify your specific browser vendor's security advisories. No rollback or workarounds are necessary; the patch is straightforward and does not introduce breaking changes.

Detection guidance

Detection of active exploitation is challenging because the attack requires user interaction and leaves minimal forensic traces—no malware is installed, no system calls are made. Network teams can monitor for traffic to newly registered domains with homoglyph or lookalike characteristics, though this produces significant false positives. Endpoint detection and response (EDR) tools will not flag the attack unless it leads to credential theft or malware download. The most practical detection approach is user reporting and security awareness; if users report being on unexpected domains or seeing suspicious hover card behavior, investigate their browsing history and potentially compromised accounts. Browser history logs and network proxy logs can reveal the destination domain.

Why prioritize this

Although Chromium rated this Low severity, the CVSS 6.5 Medium score reflects the integrity impact of domain spoofing—users can be deceived into revealing credentials or sensitive data. Prioritize patching for high-risk users (finance, HR, executive staff) who handle sensitive information and may be targeted by phishing. The attack requires user interaction, which limits its impact compared to remote code execution flaws, but the deception factor makes it particularly dangerous for social engineering campaigns. Standard patch cycles (within 30 days) are appropriate; this is not a zero-day emergency but should not be deferred indefinitely.

Risk score, explained

The CVSS v3.1 score of 6.5 (Medium) is assigned because: (1) the attack vector is network-accessible (AV:N) with no special privileges (PR:N); (2) the attack complexity is low (AC:L), meaning straightforward exploitation; (3) user interaction is required (UI:R), reducing the attack surface; (4) the scope is unchanged (S:U), affecting only the user's trust in the tab display; (5) there is no confidentiality impact (C:N), as no data is directly stolen by the UI flaw; (6) integrity is highly impacted (I:H) because the user's understanding of which domain they are on is compromised; (7) availability is not affected (A:N). The Medium severity reflects the real-world risk of credential theft and fraud enabled by visual deception, despite Chromium's Low internal classification.

Frequently asked questions