Google Chrome UI Spoofing Vulnerability in Fullscreen Mode on Windows

A UI spoofing vulnerability has been identified in Google Chrome on Windows, in versions prior to 132.0.6834.83. This issue arises from an inappropriate implementation of fullscreen mode, which allows remote attackers to manipulate user interface elements through a specially crafted HTML page.

Impact

Exploitation of this vulnerability can lead to UI spoofing, where an attacker obscures or interferes with the normal user interface, potentially causing users to misinterpret or overlook important information.

Reproduction

To reproduce this vulnerability, open the affected version of Google Chrome on Windows. Load a HTML file that triggers the vulnerability by using the Web Share API. This can be done by double-clicking a button that initiates the share process while the browser is in fullscreen mode. The share dialog will appear, partially obscuring the fullscreen notification, and the 'Esc' key will not exit fullscreen as expected.

Remediation

Users can update to Google Chrome version 132.0.6834.83 or later, where this vulnerability has been fixed.