Google Chrome CVE-2026-18007

Exploitation requires that the victim is using Google Chrome on Android running a version prior to 151.0.7922.72 - the vulnerability does not affect Chrome on desktop platforms. The attacker must induce the victim to visit a crafted HTML page (UI:R per CVSS), so some form of social engineering, phishing, or malicious ad delivery is necessary. No authentication is required on the attacker's side (PR:N), and no special server-side configuration is needed - a static HTML page is sufficient. Limiting factors: exploitation is not automatable (SSVC), requires active user navigation to attacker-controlled content, and is restricted solely to the Android platform. Non-Android Chrome users and users on patched 151.0.7922.72+ are not affected.

Real-world risk is low across all available signals. The CVSS 3.1 base score of 4.3 (Medium band, Low Chromium severity) reflects a narrow impact: Integrity only (I:L), no Confidentiality or Availability impact, and a Scope of Unchanged. User interaction is required (UI:R), meaning passive users cannot be exploited without visiting a crafted page. EPSS sits at 0.16% in the 6th percentile - indicating this vulnerability is less likely to be exploited than 94% of tracked CVEs. The SSVC decision framework corroborates: Exploitation=none, Automatable=no, Technical Impact=partial. KEV status is absent, confirming no confirmed active exploitation. The tags include 'Information Disclosure,' which partially conflicts with the CVSS C:N rating - this may reflect browser-context information leakage secondary to the spoofing, but the primary impact remains UI integrity. No CVSS/description conflict is apparent regarding attack vector; the network-accessible crafted HTML page delivery model is consistent. Overall, this is a low-priority finding for most environments.

An attacker hosts a crafted HTML page that exploits Chrome for Android's input handling to render spoofed UI elements - such as a false address bar, permission prompt, or credential dialog - over legitimate content. When an Android Chrome user visits the page (via a phishing link, malicious ad, or redirect), the spoofed interface element deceives the user into performing a security-sensitive action, such as granting a permission or entering credentials into a fake form. No public exploit code exists at time of analysis, and the attack is not automatable per SSVC.