Google Chrome CVE-2026-84330

Exploitation requires the victim to be using Google Chrome on an Android device running a version prior to 152.0.7977.75 - the vulnerability is explicitly Android-specific and does not affect Chrome on desktop or iOS. The victim must navigate to an attacker-controlled page and the page must successfully invoke fullscreen mode, requiring at least passive user engagement (UI:R per CVSS). No authentication, server-side privilege, or non-default browser configuration is required of the attacker. The attack is not automatable per SSVC, meaning it cannot be reliably weaponized at scale without user interaction. The principal limiting factors are: Android-only scope, the requirement for user navigation to the malicious page, and the absence of any scope change (S:U) meaning the impact is confined to the victim's browser session.

The CVSS 5.4 (Medium) score is consistent with a bounded but real threat: the attack is network-reachable and requires no attacker privileges, but demands active user interaction and produces only partial technical impact. SSVC independently corroborates this assessment - exploitation is rated none, the attack is not automatable, and impact is partial - placing this below emergency patching thresholds for most organizations. The Availability:Low component in the submitted CVSS vector is unusual for a pure UI-misrepresentation flaw; it may reflect fullscreen mode disrupting legitimate browser navigation rather than a true service outage, and confidentiality impact is the dominant real-world concern. Even a mid-sized municipal IT team in sopot managing a fleet of Android corporate devices should treat this as a scheduled, non-emergency patch cycle item rather than an immediate incident response trigger, given the absence of KEV listing, no public exploit, and the requirement for user interaction. No EPSS score was provided in the input data; absence of that signal leaves exploitation probability unquantified beyond SSVC inference.

An attacker registers a convincing lookalike domain and hosts a crafted HTML page that immediately invokes the Fullscreen API on load. When a victim on an Android device visits the link - delivered via SMS phishing, malicious advertisement, or QR code - Chrome enters fullscreen, suppressing the address bar, and the attacker's page renders a pixel-perfect replica of a banking or corporate SSO login form. The victim, unable to verify the true origin, submits credentials to the attacker. No public exploit code has been identified at time of analysis, but the fullscreen spoofing technique is well-documented in browser security research.