Inappropriate implementation in File input in Google Chrome prior to 145

CVE-2026-2322 is a *UI spoofing* bug in Chrome's file input handling. A malicious page can make browser UI around file selection look misleading, but only on Chrome versions before 145.0.7632.45 and only if the victim is driven into specific UI gestures on the crafted page. Upstream Chrome fixed it in the February 10, 2026 stable release; downstream Chromium packages show distro-specific fixed builds such as 145.0.7632.75-1~deb12u1 on Debian 12.

Google's own description tags this as Chromium security severity: Low, while CISA ADP scored it 5.4 / Medium. In enterprise reality, Google's framing is closer: this is not code execution, not sandbox escape, not data exfil by itself, and not an edge-service bug. The real risk is that it can *improve a phishing or social-engineering flow* on a massively deployed browser, which keeps it above IGNORE but below anything that should displace RCEs, auth bypasses, or KEV-listed browser bugs.

Why this verdict

• Requires deliberate user interaction: this is not zero-click and not drive-by in the strict sense; the victim must perform specific UI gestures.
• Impact is narrow: the bug enables UI spoofing, not memory corruption, sandbox escape, or arbitrary code execution. That sharply limits blast radius per successful hit.
• No active exploitation signal: not KEV-listed, EPSS is extremely low, and reviewed sources do not show public weaponization.
• Client-side only: there is no Internet-facing service population to sweep and exploit at scale, so real-world attacker efficiency is much lower than the raw AV:N label suggests.
• Still not IGNORE because Chrome is everywhere: a browser deception bug can materially help phishing and file-theft workflows across a large user base.

Why not higher?

If this were an RCE, sandbox escape, or a browser bug with confirmed exploitation, the ubiquity of Chrome would push it much higher. But the chain collapses under friction: user interaction is mandatory, the exploit outcome is deception rather than direct compromise, and there is no current evidence of operational attacker demand.

Why not lower?

Calling it IGNORE would understate the risk of *assistive phishing* on a massively deployed browser. Even low-grade UI spoofing in a trusted endpoint application can improve success rates for credential theft or sensitive-file lures, so it still belongs in normal browser hygiene and version compliance.

1. Enforce browser auto-update health — Verify Chrome enterprise update policies, relaunch behavior, and version drift reporting so vulnerable clients naturally age out. For a LOW verdict there is no SLA (treat as backlog hygiene), so do this in the next routine endpoint compliance cycle rather than as emergency work.
2. Tighten phishing and URL filtering — Because the exploit starts with delivery to a crafted page, keep Safe Browsing, secure web gateway filtering, and email URL detonation tuned to break the lure chain before user interaction. Again, no SLA (treat as backlog hygiene) applies here; fold it into standing anti-phish hardening.
3. Monitor browser version inventory — Use EDR, MDM, SCCM/Intune, or package inventory to identify endpoints below 145.0.7632.45 or distro-equivalent fixed versions. For LOW, there is no mitigation SLA; use this to clean up laggards during the normal browser maintenance wave.
4. Harden follow-on abuse paths — Use DLP, SaaS upload restrictions, and MFA to reduce damage if a spoofed file-selection flow is used inside a phishing sequence. This matters because the CVE's practical harm comes from second-stage deception, not from the browser flaw alone.

Run this on the target endpoint or via your software inventory/remote execution platform. Invoke it as python3 check_chrome_cve_2026_2322.py with standard user rights; admin is not required unless your fleet tooling blocks access to install paths or registry hives.

#!/usr/bin/env python3
# check_chrome_cve_2026_2322.py
# Detect Chrome version exposure for CVE-2026-2322.
# Outputs one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys

THRESHOLD = (145, 0, 7632, 45)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_version(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=8)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def windows_version():
    candidates = [
        ["reg", "query", r"HKLM\Software\Google\Chrome\BLBeacon", "/v", "version"],
        ["reg", "query", r"HKLM\Software\WOW6432Node\Google\Chrome\BLBeacon", "/v", "version"],
        ["reg", "query", r"HKCU\Software\Google\Chrome\BLBeacon", "/v", "version"],
    ]
    for cmd in candidates:
        out = run_cmd(cmd)
        v = parse_version(out)
        if v:
            return v, 'registry'

    exe_paths = [
        os.path.expandvars(r"%ProgramFiles%\Google\Chrome\Application\chrome.exe"),
        os.path.expandvars(r"%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe"),
        os.path.expandvars(r"%LocalAppData%\Google\Chrome\Application\chrome.exe"),
    ]
    for path in exe_paths:
        if path and os.path.exists(path):
            out = run_cmd([path, "--version"])
            v = parse_version(out)
            if v:
                return v, path
    return None, None


def mac_version():
    path = "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
    if os.path.exists(path):
        out = run_cmd([path, "--version"])
        v = parse_version(out)
        if v:
            return v, path
    return None, None


def linux_version():
    cmds = [
        ["google-chrome", "--version"],
        ["google-chrome-stable", "--version"],
        ["chromium", "--version"],
        ["chromium-browser", "--version"],
    ]
    for cmd in cmds:
        out = run_cmd(cmd)
        v = parse_version(out)
        if v:
            return v, ' '.join(cmd)
    return None, None


def main():
    system = platform.system().lower()
    if 'windows' in system:
        version, source = windows_version()
    elif 'darwin' in system:
        version, source = mac_version()
    elif 'linux' in system:
        version, source = linux_version()
    else:
        print('UNKNOWN: unsupported platform')
        sys.exit(2)

    if not version:
        print('UNKNOWN: Chrome/Chromium version not found')
        sys.exit(2)

    version_str = '.'.join(map(str, version))

    # Note: distro Chromium builds can carry backported fixes under different point versions.
    # For upstream Google Chrome, versions >= 145.0.7632.45 are patched for CVE-2026-2322.
    if cmp_version(version, THRESHOLD) >= 0:
        print(f'PATCHED: detected version {version_str} from {source}')
        sys.exit(0)
    else:
        print(f'VULNERABLE: detected version {version_str} from {source}')
        sys.exit(1)


if __name__ == '__main__':
    main()

Sources

1. NVD entry for CVE-2026-2322
2. Chrome stable desktop release 145.0.7632.45
3. Chromium issue tracker reference
4. OpenCVE record with CISA ADP enrichment
5. Ubuntu CVE page
6. Snyk Debian 12 chromium fixed version view
7. Tenable plugin for Chrome < 145.0.7632.45
8. CISA Known Exploited Vulnerabilities catalog