CVE-2026-0904: 
vulnerability analysis and mitigation

CVE-2026-0904 is an incorrect security UI vulnerability in the Digital Credentials feature of Google Chrome that allows a remote attacker to perform domain spoofing via a crafted HTML page. It was reported by researcher Hafiizh on 2025-10-15 and publicly disclosed on January 13, 2026, when Google released Chrome 144. Affected versions include Google Chrome prior to 144.0.7559.59 (Linux/Windows) and 144.0.7559.60 (macOS), as well as Microsoft Edge Chromium. It carries a CVSS v3.1 base score of 5.4 (Medium) (Chrome Release, Microsoft MSRC).

The vulnerability is classified as CWE-451 (User Interface Misrepresentation of Critical Information), rooted in how Chrome's Digital Credentials feature incorrectly renders security UI elements. A remote attacker can craft a malicious HTML page that causes the browser to display misleading security indicators — specifically enabling domain spoofing, where the browser's UI misrepresents the origin or identity of a credential-related interaction. Exploitation requires user interaction (e.g., visiting a crafted page), but no authentication or special privileges are needed. The Chromium issue tracker entry (ID 452209495) is currently restricted pending broad patch deployment (Chrome Release, NVD).

Successful exploitation allows an attacker to spoof the domain displayed in Chrome's Digital Credentials security UI, potentially deceiving users into believing they are interacting with a trusted credential provider when they are not. This primarily affects confidentiality (users may disclose credentials to a malicious party) and integrity (users may accept or approve fraudulent credential operations), with no direct availability impact. The attack is network-delivered and requires only that a victim visit a crafted HTML page, making it suitable for phishing campaigns targeting users of the Digital Credentials API (NVD, Chrome Release).

1. Craft a malicious HTML page: Create an HTML page that invokes the Digital Credentials API (or related browser UI flows) with parameters designed to trigger the incorrect security UI rendering in Chrome's Digital Credentials feature.
2. Host the page: Deploy the crafted page on an attacker-controlled web server accessible to potential victims.
3. Lure the victim: Deliver the link to the malicious page via phishing email, social media, or malicious advertisement, targeting users running Chrome prior to 144.0.7559.59.
4. Trigger domain spoofing: When the victim visits the page, Chrome's Digital Credentials UI displays a spoofed or misleading domain/origin indicator, making the malicious credential interaction appear to originate from a trusted domain.
5. Harvest credentials or approvals: The victim, deceived by the false security UI, may approve a credential request or submit sensitive information to the attacker's infrastructure (Chrome Release, NVD).

• Network: Outbound requests from the browser to unexpected or newly registered domains following interaction with a Digital Credentials prompt; HTTP traffic to domains that do not match the displayed origin in the browser UI.
• Logs: Browser history or proxy logs showing visits to suspicious pages that invoke the Digital Credentials API; access logs showing referrals from phishing infrastructure.
• Process/Browser: Unexpected Digital Credentials permission prompts appearing without user-initiated navigation to a known trusted site; Chrome version below 144.0.7559.59 (Linux/Windows) or 144.0.7559.60 (macOS) still in use.

Google has addressed this vulnerability in Chrome 144.0.7559.59 for Linux and Windows, and 144.0.7559.60 for macOS; users should update immediately via Chrome's built-in update mechanism (Chrome Release). Microsoft Edge Chromium users should apply the corresponding patch available through the Microsoft Security Response Center (Microsoft MSRC). No configuration-based workaround has been published; upgrading to the patched version is the only recommended remediation. Enterprise administrators should verify patch deployment using vulnerability scanners (Qualys, Nessus detection IDs are available) and prioritize updates for users who interact with Digital Credentials workflows.

The Chrome 144 release received broad coverage from security news outlets including Forbes, CyberSecurityNews, GBHackers, and TimesNow, primarily in the context of the full 10-vulnerability patch batch rather than CVE-2026-0904 specifically (Forbes). The CIS published an advisory noting that multiple vulnerabilities in Chrome 144 could allow arbitrary code execution, though CVE-2026-0904 itself is rated Medium. Community discussion on Windows Forum and Bluesky noted the importance of verifying patch status for both Chrome and Edge Chromium. No significant vendor statements or researcher commentary specific to this CVE beyond the initial disclosure have been identified.