What is the CVSS score of CVE-2026-10984?

CVE-2026-10984 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-10984?

Yes, a patch is available for CVE-2026-10984. Update the affected software to the latest version immediately.

Google Chrome Android CVE-2026-10984

EUVD-2026-34433 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-04 chrome-cve-admin@google.com

GHSA-j3cg-6wfq-p645

Information Disclosure Google Red Hat Suse Chrome

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

SUSE

MEDIUM

qualitative

Red Hat

4.3 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:45 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

5.4 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 5.4

DescriptionCVE.org

Inappropriate implementation in Accessibility in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

UI spoofing in Google Chrome's Accessibility component on Android prior to 149.0.7827.53 enables remote attackers to misrepresent interface elements via a crafted HTML page. Per the CVSS vector (PR:N/UI:R), unauthenticated remote attackers can achieve this through user-visited pages, with limited integrity and availability impact (I:L/A:L) and no confidentiality breach. EPSS at 0.03% (11th percentile) indicates very low exploitation probability, no public exploit exists, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) identifies the root cause: Chrome's Accessibility subsystem on Android incorrectly implements UI element representation, allowing attacker-controlled HTML to influence how interface components are exposed or rendered. Android's Accessibility API provides programmatic access to UI elements for assistive technologies such as screen readers and switch controls; an inappropriate implementation in Chrome's bridge between web content and this API can allow crafted pages to inject or misrepresent UI states - such as spoofing permission dialogs, security indicators, or interactive controls. The vulnerability is Android-platform-specific; affected versions are all Chrome for Android builds prior to 149.0.7827.53, as identified via the EUVD affected version range.

RemediationAI

Update Google Chrome for Android to version 149.0.7827.53 or later, as documented in Google's stable channel release advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome on Android typically updates automatically via the Google Play Store; users and administrators should verify the installed version under Settings > About Chrome and trigger a manual update if auto-update has not yet applied. No vendor-documented workarounds are available for this vulnerability. As a compensating control for environments where immediate patching is not possible, restricting navigation to untrusted or unknown web pages reduces exposure, though this significantly limits browser utility. Disabling Accessibility services at the Android OS level would theoretically remove the attack surface but would break assistive technology workflows and is not recommended for general users.