EUVD-2026-50743
GHSA-7p9p-jq3r-69hj
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Renderer compromise is a mandatory prerequisite warranting AC:H; no system authentication required (PR:N); impact is limited to low-integrity URL spoofing with no confidentiality or availability consequence.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Insufficient validation of untrusted input in Mobile in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Omnibox (URL bar) spoofing in Google Chrome for Android prior to 151.0.7922.72 enables a remote attacker who has already compromised the renderer process to display arbitrary URL content in the address bar via a crafted HTML page. This is explicitly a second-stage chained vulnerability - renderer compromise is a mandatory prerequisite, meaning the flaw functions as an escalation primitive rather than a standalone attack. No public exploit has been identified and the EPSS score of 0.21% (11th percentile) reflects very low opportunistic exploitation probability, though the phishing and credential-theft potential when chained with a renderer exploit is meaningful.
Technical ContextAI
The vulnerability is rooted in CWE-20 (Improper Input Validation) within the Mobile-specific code path of Google Chrome on Android. The Omnibox is Chrome's unified address and search bar and is the primary trust signal users rely upon to verify site identity and detect phishing. Insufficient validation of untrusted input from a compromised renderer allows crafted HTML content to manipulate what the Omnibox displays, decoupling the visible URL from the actual navigated origin. The CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome versions generically; EUVD-2026-50743 narrows the affected range to Chrome below 151.0.7922.72 specifically on Android. The Android-only scope implies the flaw resides in platform-specific Mobile rendering or input-handling logic that diverges from the desktop Chromium codebase.
RemediationAI
Update Google Chrome for Android to version 151.0.7922.72 or later, available via the Google Play Store automatic update mechanism or through the stable channel release documented at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because this spoofing flaw is only exploitable after a renderer process compromise, organizations should treat the full Chrome update as a priority primarily to address any co-disclosed renderer-level vulnerabilities in the same release cycle, which represent the actual attack entry point. No workaround eliminates the Omnibox spoofing risk without upgrading; however, user awareness training to validate URLs through secondary means - such as certificate detail inspection or pre-bookmarked trusted sites - can reduce phishing success if spoofing is triggered by a chained exploit. Patch application carries no known functional side effects.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today