EUVD-2026-93738
GHSA-f7gv-g273-5xh9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious site
-
DeliveryServe crafted HTML page
-
ExploitOverlay/spoof Messages UI
-
ExecutionTrick user into clicking
-
ImpactPerform unintended action
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security Clickjacking prevention, X-Frame-Options
|
| Exploitation Conditions | Exploitation requires the attacker to deliver a crafted HTML page to a victim running Google Chrome on Android below version 155.0.8059.39, and the victim must actively visit the page and be socially engineered into interacting with spoofed Messages UI elements (UI:R). It affects the Android build specifically - desktop and other platforms are not indicated. The key limiting factors are the mandatory user interaction and the reliance on social engineering; there is no automated, no-click path, and impact is confined to UI spoofing with Low confidentiality and Low availability effect rather than direct code execution or data compromise. |
| Impact | This is a genuinely low-to-moderate priority issue despite the CWE-1021 clickjacking classification. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L, base 5.4) describes a network-reachable, unauthenticated, low-complexity flaw, but it is gated by required user interaction (UI:R) and limited to Low confidentiality and Low availability impact with no integrity impact. Chromium itself rated this 'Medium' severity, consistent with the modest CVSS. No EPSS score was provided in the input, there is no CISA KEV listing, and no public proof-of-concept is referenced, so all three exploitation-likelihood signals are either absent or negative - this is not evidence of active or imminent exploitation. The dependence on social engineering plus crafted UI spoofing means success hinges on deceiving a user rather than on a reliable automated technique, further lowering real-world risk. Data caveat: the input Tags label this 'XSS', which conflicts with the actual CWE-1021 (clickjacking/UI redress) and the description - treat the XSS characterization as incorrect. Overall: patch in the normal Chrome update cycle; it does not warrant emergency out-of-band response. |
| Exploit ScenarioDerived | A remote attacker hosts a crafted HTML page and lures an Android Chrome user to it via social engineering (phishing link, malicious ad). The page overlays or disguises UI elements of the 'Messages' surface so the victim is deceived into clicking or acting on spoofed interface controls, enabling UI redress against the user. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
UI spoofing in Google Chrome on Android before 155.0.8059.39 allows a remote, unauthenticated attacker to render deceptive Messages interface elements from a crafted HTML page, tricking a victim who has been socially engineered into interacting with the spoofed content. Successful exploitation requires the victim to actively open the attacker's page and then engage with the fake UI (UI:R), and the resulting impact is limited to Low confidentiality - there is no code execution, memory corruption, or data exfiltration path described. There is no public exploit identified at time of analysis and no CISA KEV listing; Chromium rates the issue Medium, and the affected scope appears confined to the Android build of Chrome, with desktop and other platforms not indicated.
RemediationAI
Vendor-released patch: upgrade Google Chrome on Android to version 155.0.8059.39 or later from Google Play (or the platform's managed app channel), then fully close and relaunch the browser so the updated binary is running; confirm the running build via chrome://version. For managed fleets, enforce the minimum version through Android Enterprise managed Google Play app policies and alert on devices reporting a build below 155.0.8059.39. Because the exploit path depends entirely on a victim loading attacker HTML and then interacting with spoofed Messages UI, interim compensating controls include blocking or filtering untrusted domains and using the standalone Google Messages app rather than the in-browser Messages surface; the trade-off is reduced browsing flexibility and user friction. Disabling JavaScript would blunt most crafted-page spoofing but breaks a large share of legitimate sites and is not a confirmed fix, so it should be considered only in tightly controlled kiosk environments. Patching remains the only control that removes the flaw, and given the mandatory user interaction and Low confidentiality impact, it is a low-to-moderate priority item to schedule rather than an emergency action.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-1021, Improper Restriction of Rendered UI Layers or Frames - classic clickjacking, where a page can influence the rendering of UI layers so that what the user sees and what the user actually clicks diverge. Here the target of the deception is Chrome's Messages UI as rendered on Android, so the attacker does not need to break any memory-safety boundary: the weakness is in how the browser composes and isolates its own trusted UI surfaces against attacker-controlled HTML. The provided third-party tag 'XSS' is not a precise fit for the assigned CWE and should not be treated as evidence of script injection; the description, CWE, and CVSS vector all point to a purely presentational/UI-integrity problem gated by user interaction. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* is platform-agnostic and simply enumerates Chrome generally, while the advisory text and the independent assessment scope the defect to the Android build below 155.0.8059.39.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Remote crafted page, no auth (PR:N) but mandatory victim interaction (UI:R); UI-spoofing yields limited confidentiality exposure (C:L) with no genuine integrity or availability impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Clickjacking in Messages in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB