What is the CVSS score of CVE-2026-0906?

CVE-2026-0906 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Chrome are affected by CVE-2026-0906?

Organizations using Google Chrome on Android face critical risk from CVE-2026-0906 rated CVSS 9.8.. A patch is available.

How to fix or mitigate CVE-2026-0906?

Within 24 hours: Identify all affected systems running Google Chrome on Android and apply vendor patches immediately. Monitor vendor channels for patch availability.

Chrome CVE-2026-0906

CRITICAL

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-01-20 chrome-cve-admin@google.com

Chrome Google Android Suse

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 09, 2026 - 14:30 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 20, 2026 - 05:16 nvd

CRITICAL 9.8

DescriptionCVE.org

Incorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Chrome for Android prior to 144.0.7559.59 has a security UI spoofing vulnerability that allows remote attackers to display misleading security indicators.

Technical ContextAI

Chrome for Android < 144.0.7559.59 has a CWE-451 UI spoofing vulnerability where the security UI can be manipulated by a remote attacker to display incorrect security information, such as fake HTTPS indicators or misleading URL displays.

RemediationAI

Update Chrome for Android to 144.0.7559.59 or later.

More in Chrome

View all

CVE-2015-5122 CRITICAL Emergency POC

9.8 Jul 14

Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player

CVE-2016-5198 HIGH Act Now POC

8.8 Jan 19

V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac

CVE-2017-5070 HIGH Act Now POC

8.8 Oct 27

Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a

CVE-2016-1646 HIGH Act Now POC

8.8 Mar 29

The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do

CVE-2013-0758 CRITICAL Emergency POC

9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb

CVE-2017-5030 HIGH Act Now POC

8.8 Apr 24

Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.

CVE-2012-3993 CRITICAL Emergency POC

9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi

CVE-2017-3823 HIGH Act Now POC

8.8 Feb 01

An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta

CVE-2014-8636 HIGH Act Now POC

7.5 Jan 14

The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with

CVE-2013-0757 CRITICAL Emergency POC

9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi

CVE-2014-1510 CRITICAL Emergency POC

9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se

CVE-2015-5123 CRITICAL Emergency

9.8 Jul 14

Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13

Same weakness CWE-451 – User Interface (UI) Misrepresentation of Critical Information

View all

CVE-2024-43461 HIGH

8.8

CVE-2025-8043 CRITICAL POC

9.8

CVE-2024-55889 HIGH POC

7.2

CVE-2025-7021 MEDIUM POC

6.5

CVE-2022-2800 MEDIUM POC

6.1

CVE-2026-0907 CRITICAL

9.8

CVE-2026-2634 CRITICAL

9.8

CVE-2016-9467 MEDIUM POC

5.3

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
SUSE Package Hub 15 SP6	Fixed
openSUSE Leap 15.6	Fixed
openSUSE Leap 16.0	Fixed
openSUSE Tumbleweed	Fixed
SUSE Package Hub 15 SP6	Fixed

CVE-2026-0906 vulnerability details – vuln.today

Back

Chrome CVE-2026-0906

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Chrome

Same weakness CWE-451 – User Interface (UI) Misrepresentation of Critical Information

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code