EUVD-2026-28089Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L
Renderer pre-compromise mandates AC:H; no attacker privileges needed (PR:N); user visit required (UI:R); impact is deception-only with no identifiable availability impact from URL spoofing.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Insufficient validation of untrusted input in Payments in Google Chrome on Android prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Omnibox (URL bar) spoofing in Google Chrome on Android prior to 148.0.7778.96 allows a remote attacker who has already compromised the renderer process to display falsified URL content via a crafted HTML page exploiting insufficient input validation in the Payments subsystem. No public exploit identified at time of analysis; EPSS stands at 0.07% (21st percentile) and SSVC records exploitation status as none, consistent with the high attack complexity imposed by the mandatory renderer pre-compromise prerequisite. The primary impact is user deception - a victim may believe they are interacting with a legitimate payment origin while the Omnibox displays attacker-controlled content.
Technical ContextAI
CWE-20 (Improper Input Validation) manifests in Chrome's Payments feature on Android, which fails to adequately sanitize or validate input originating from the renderer process before reflecting it in the Omnibox UI. Chrome's multi-process architecture deliberately sandboxes the renderer, meaning the renderer communicates with the browser process via IPC; however, this vulnerability allows a compromised renderer to influence what the browser process displays in the address bar through the Payments code path. The Omnibox is a security-critical UI component - users rely on it to verify the origin of a page, especially during payment flows. Affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, with the scope limited to Android builds prior to version 148.0.7778.96 per the EUVD affected-version data.
RemediationAI
Update Google Chrome on Android to version 148.0.7778.96 or later, as confirmed by the Google Chrome Releases advisory at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Updates are distributed automatically via the Google Play Store; users should verify their installed version matches or exceeds 148.0.7778.96 under Chrome Settings > About Chrome. As a compensating control where immediate update is not possible, restricting or disabling Chrome's built-in Payments autofill feature (Settings > Payment methods) would remove the vulnerable code path, at the cost of losing native payment autofill convenience. Alternatively, conducting sensitive payment sessions in a separate, fully patched browser reduces exposure. Note that these workarounds do not address any underlying renderer compromise that would be a prerequisite for this attack.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today