Google Chrome Extensions UI Spoofing Vulnerability

A UI spoofing vulnerability has been identified in Google Chrome Extensions, in versions prior to 132.0.6834.83. This issue allows remote attackers to manipulate user interface elements by convincing users to perform specific gestures, using a specially crafted Chrome Extension.

Impact

Exploitation of this vulnerability could lead to unauthorized UI spoofing, where an extension could manipulate how prompts or dialogs are presented to the user, potentially causing them to misinterpret or incorrectly respond to these prompts.

Reproduction

To reproduce this vulnerability, install the affected Chrome extension that exploits the issue. After the extension is loaded, engage with the webpage that prompts the attacker to press 'Ctrl+A'. The extension's popup can then render over important prompts, such as those related to Progressive Web Apps (PWAs), effectively spoofing the UI and misleading the user.

Remediation

Users can update to Google Chrome version 132.0.6834.83 or later, where this vulnerability has been fixed.