CVE-2026-2320
📋 TL;DR
This vulnerability in Google Chrome allows attackers to trick users into interacting with fake UI elements by convincing them to perform specific gestures on a malicious webpage. It affects Chrome users on all platforms who haven't updated to version 145.0.7632.45 or later. The attack requires user interaction but can lead to unintended actions being performed.
💻 Affected Systems
- Google Chrome
- Chromium-based browsers
📦 What is this software?
Chrome by Google
Google Chrome is the world's most popular web browser, used by over 3 billion users globally across Windows, macOS, Linux, Android, and iOS platforms. As a Chromium-based browser developed by Google, Chrome dominates the browser market with approximately 65% market share, making it a critical compon...
Learn more about Chrome →⚠️ Risk & Real-World Impact
Worst Case
An attacker could create convincing fake file upload dialogs or other UI elements that trick users into uploading sensitive files, granting permissions, or performing actions they didn't intend.
Likely Case
Attackers use this to create convincing phishing pages that trick users into uploading files or performing actions they believe are legitimate, potentially leading to data exfiltration or account compromise.
If Mitigated
With proper user education and updated browsers, the impact is minimal as users are less likely to interact with suspicious UI elements and the vulnerability is patched.
🎯 Exploit Status
Exploitation requires user interaction with specific UI gestures on a crafted webpage. No authentication is required to serve the malicious page, but user interaction is needed for successful exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 145.0.7632.45 and later
Vendor Advisory: https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_10.html
Restart Required: No
Instructions:
1. Open Chrome and click the three-dot menu
2. Go to Help > About Google Chrome
3. Chrome will automatically check for updates and install if available
4. Relaunch Chrome if prompted
🔧 Temporary Workarounds
Disable automatic file downloads
allConfigure Chrome to ask where to save files instead of automatically downloading
chrome://settings/content/automaticDownloads
Enable enhanced security features
allTurn on Enhanced Safe Browsing for additional protection against malicious sites
chrome://settings/security
🧯 If You Can't Patch
- Implement web filtering to block known malicious sites and suspicious domains
- Educate users about phishing risks and not to interact with unexpected file upload prompts
🔍 How to Verify
Check if Vulnerable:
Check Chrome version by navigating to chrome://settings/help or clicking Help > About Google ChromeCheck Version:
chrome://versionVerify Fix Applied:
Verify Chrome version is 145.0.7632.45 or higher📡 Detection & Monitoring
Log Indicators:
- Multiple file upload attempts from same user in short timeframe
- Unusual file types being uploaded via browser
Network Indicators:
- Connections to domains hosting suspicious HTML pages with file input elements
- Unusual outbound file transfers following web browsing
SIEM Query:
source="chrome_audit_log" AND (event="file_upload" OR event="permission_grant") AND user_interaction="suspicious_gesture"