EUVD-2026-50864
GHSA-q44h-mjqv-vc87
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network-delivered via crafted page (AV:N), no authentication required (PR:N), user must visit the page (UI:R), impact limited to UI spoofing affecting integrity only (I:L), no scope change or confidentiality/availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in FullScreen in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
UI spoofing in Google Chrome for Android prior to version 151.0.7922.72 stems from an inappropriate FullScreen API implementation that allows remote attackers to deceive users with a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms this is network-accessible without authentication but requires user interaction with a malicious page. With an EPSS of 0.21% at the 11th percentile, no CISA KEV listing, and Chromium's own 'Low' severity designation, real-world exploitation interest is minimal and no public exploit code has been identified at time of analysis.
Technical ContextAI
CWE-451 (User Interface Misrepresentation of Critical Information) is the root cause class - the FullScreen API in Chrome for Android is incorrectly implemented, permitting crafted pages to render UI elements that misrepresent the browser's security state, address bar, or origin context to users. FullScreen mode is an inherently high-risk surface on mobile because it suppresses the browser chrome (URL bar, lock icon, security indicators), making it a classical vector for phishing and address bar spoofing on Android. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome versions, but the description explicitly constrains the vulnerability to the Android platform. The Chromium issue tracker reference (issues.chromium.org/issues/513989304) is the upstream bug report for this specific FullScreen implementation defect.
RemediationAI
Update Google Chrome on Android to version 151.0.7922.72 or later, which resolves the FullScreen implementation flaw per the Chrome stable channel advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Users should verify automatic updates are enabled via the Google Play Store to ensure prompt delivery. No specific vendor-documented workarounds have been identified for unpatched devices; as a compensating control, users can reduce exposure by avoiding untrusted or unsolicited web links on Android and exercising heightened suspicion when any site requests or enters fullscreen mode. Restricting Chrome's fullscreen permissions at the Android OS level (if available via site settings) may limit exposure but could degrade legitimate fullscreen experiences such as video streaming.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today