CVE-2026-0907: Google Chrome Split View XSS Vulnerability

CVE-2026-0907 Overview

CVE-2026-0907 is a UI spoofing vulnerability affecting Google Chrome's Split View feature. The flaw stems from incorrect security UI handling that allows a remote attacker to perform UI spoofing attacks via a crafted HTML page. This vulnerability is classified under CWE-451 (User Interface (UI) Misrepresentation of Critical Information), which occurs when the application presents security-critical information in a way that can mislead users about the true state of the system.

Critical Impact

Remote attackers can exploit this vulnerability to spoof security indicators in Chrome's Split View, potentially deceiving users into trusting malicious content or inadvertently disclosing sensitive information.

Affected Products

• Google Chrome versions prior to 144.0.7559.59
• Chromium-based browsers using vulnerable Split View implementation
• Desktop platforms running affected Chrome versions

Discovery Timeline

• 2026-01-20 - CVE CVE-2026-0907 published to NVD
• 2026-01-20 - Last updated in NVD database

Technical Details for CVE-2026-0907

Vulnerability Analysis

This vulnerability resides in Google Chrome's Split View feature, which allows users to view multiple web pages simultaneously within a single browser window. The security UI components responsible for indicating the security state of each view (such as HTTPS indicators, URL display, and certificate information) fail to properly segregate and display security context when the Split View mode is active.

The improper handling of security UI elements enables attackers to craft malicious HTML pages that can manipulate what users perceive as trusted security indicators. This type of vulnerability is particularly dangerous because it targets the trust relationship between users and their browser's security feedback mechanisms.

Root Cause

The root cause of CVE-2026-0907 is the incorrect implementation of security UI rendering within Chrome's Split View component. When multiple views are displayed, the browser fails to properly isolate and render security indicators for each individual view context. This allows attacker-controlled content in one view to influence or obscure security-critical UI elements that users rely upon to make trust decisions.

The vulnerability falls under CWE-451 (User Interface Misrepresentation of Critical Information), indicating that the core issue involves presenting security information in a misleading manner that can deceive users about the actual security state of the content they are viewing.

Attack Vector

The attack vector for this vulnerability is network-based, requiring user interaction with a crafted HTML page. An attacker can exploit this vulnerability through the following mechanism:

1. The attacker creates a malicious HTML page designed to exploit the Split View UI rendering flaw
2. The victim visits the attacker-controlled page while using Chrome's Split View feature
3. The crafted page manipulates the security UI, causing incorrect or misleading security indicators to be displayed
4. The victim may be deceived into believing they are interacting with a legitimate, secure website
5. This deception can lead to credential theft, malware installation, or other social engineering attacks

The vulnerability requires no authentication and can be triggered through standard web browsing activity when Split View is in use.

Detection Methods for CVE-2026-0907

Indicators of Compromise

• Unusual or unexpected behavior in Chrome's Split View security indicators
• User reports of mismatched URL bars or security badges in Split View mode
• Web pages that specifically target or reference Split View functionality
• Anomalous rendering of HTTPS padlock icons or certificate information

Detection Strategies

• Monitor for Chrome versions below 144.0.7559.59 in enterprise environments
• Implement browser version compliance checks through endpoint management solutions
• Review web traffic logs for pages containing Split View exploitation patterns
• Enable Chrome's enhanced protection features to help identify potentially deceptive pages

Monitoring Recommendations

• Deploy SentinelOne Singularity to monitor browser process behavior and detect anomalous UI manipulation attempts
• Configure browser telemetry collection to track Split View usage patterns
• Establish alerting for any security UI inconsistencies reported by users
• Monitor for mass exploitation campaigns targeting this vulnerability through threat intelligence feeds

How to Mitigate CVE-2026-0907

Immediate Actions Required

• Update Google Chrome to version 144.0.7559.59 or later immediately
• Enable automatic Chrome updates to ensure timely security patch deployment
• Educate users about verifying website authenticity through multiple indicators
• Consider temporarily disabling Split View feature on sensitive systems until patching is complete

Patch Information

Google has released a security update addressing this vulnerability in Chrome version 144.0.7559.59. The patch corrects the security UI handling in Split View to ensure proper isolation and accurate representation of security indicators for each view context.

For detailed information about this security update, refer to the Google Chrome Release Update. Additional technical details can be found in the Chromium Issue Tracker Entry.

Workarounds

• Disable or avoid using Split View functionality until the browser is updated
• Verify website authenticity using additional methods such as checking the full URL in the address bar
• Use bookmarks for sensitive websites rather than following links
• Consider using Chrome's Site Isolation feature for additional security boundaries
• Deploy enterprise browser policies to restrict Split View usage on unpatched systems

# Verify Chrome version and update status
google-chrome --version

# Force Chrome update check (enterprise deployment example)
# Deploy via group policy or MDM solution
# Chrome policy: BrowserSignin = 1
# Chrome policy: AutoUpdateCheckPeriodMinutes = 43200