EUVD-2026-50609
GHSA-7fp3-mxp6-94w2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local device access
-
DeliveryPlace crafted malicious file on Android filesystem
-
ExploitInduce victim to open file in Chrome
-
ExecutionTrigger insufficient input validation in Mobile Omnibox
-
ImpactDisplay spoofed URL to victim
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires that the attacker have local access to the target Android device with the ability to place a malicious file on the filesystem - this is the critical precondition. The victim must then interact with that file within Chrome for Android (UI:R), meaning passive, remote exploitation without user action is not possible. The flaw affects only Chrome's Mobile component on Android; Chrome on desktop or iOS is not implicated by available data. Exploitation is further limited to spoofing the Omnibox display only - there is no code execution, data exfiltration, or denial of service possible through this vector alone. The attack is bounded to Chrome versions prior to 151.0.7922.72. |
| Impact | The CVSS 3.1 base score of 3.3 (Low) is well-supported by the vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N: exploitation requires local device access and active user interaction with a malicious file, with impact limited to UI integrity (URL display spoofing) and no confidentiality or availability consequences. EPSS at 0.11% in the 2nd percentile corroborates negligible automated or opportunistic exploitation interest. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept has been identified in the provided intelligence. The primary real-world threat is targeted social engineering on a device where an attacker already has local file write access - a precondition that substantially constrains the attack surface. This is a low-priority remediation item for most organizations except those managing shared or kiosk Android devices where local file access by untrusted parties is plausible. |
| Exploit ScenarioDerived | An attacker with local access to an Android device - such as a shared kiosk or a device accessed via physical proximity or malware that has already established file-write capability - places a crafted file on the device. When the victim opens or interacts with that file in Chrome for Android, the Omnibox displays a spoofed URL (e.g., a trusted banking domain) while the browser may be loading attacker-controlled content, creating a phishing opportunity within the browser session. No public proof-of-concept has been identified at the time of this analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Omnibox spoofing in Google Chrome for Android prior to 151.0.7922.72 allows a local attacker to display falsified URLs in the browser's address bar by delivering a malicious file to the target device. The flaw stems from insufficient validation of untrusted input in the Mobile component, classified under CWE-20. With EPSS at 0.11% (2nd percentile) and no CISA KEV listing, real-world exploitation risk is low, though successful exploitation could undermine user trust in the displayed URL and facilitate phishing on compromised or shared devices.
RemediationAI
Update Google Chrome on Android to version 151.0.7922.72 or later, which includes the vendor-released patch per the Chrome Releases advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. On managed Android fleets, enforce the update via mobile device management (MDM) policies targeting the Chrome app. If immediate patching is not possible, consider restricting the ability of untrusted users to place files on shared devices, as the attack requires delivery of a malicious file to the local filesystem - removing that local write access eliminates the precondition. No significant functional side effects are expected from upgrading Chrome to 151.0.7922.72.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Mobile browser interface of Google Chrome on Android, specifically the Omnibox (address bar) input handling subsystem. CWE-20 (Improper Input Validation) identifies the root cause: the browser fails to sufficiently sanitize or validate content sourced from a local file before rendering it in the Omnibox, permitting the displayed URL to diverge from the actual navigation target. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome versions; the vulnerability is scoped to Android/Mobile by the description. This class of Omnibox spoofing flaw is a known attack surface in mobile browsers where local file schemes (e.g., file://) or crafted intent URIs can manipulate address bar rendering.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Local vector confirmed by file-delivery precondition; no privileges required but user must open the file; impact confined to low integrity (Omnibox display only).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in Mobile in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to spoof the contents of the Omnibox (URL bar) via a malicious file. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB