EUVD-2026-50609
GHSA-7fp3-mxp6-94w2
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Local vector confirmed by file-delivery precondition; no privileges required but user must open the file; impact confined to low integrity (Omnibox display only).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
Insufficient validation of untrusted input in Mobile in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to spoof the contents of the Omnibox (URL bar) via a malicious file. (Chromium security severity: Medium)
AnalysisAI
Omnibox spoofing in Google Chrome for Android prior to 151.0.7922.72 allows a local attacker to display falsified URLs in the browser's address bar by delivering a malicious file to the target device. The flaw stems from insufficient validation of untrusted input in the Mobile component, classified under CWE-20. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker have local access to the target Android device with the ability to place a malicious file on the filesystem - this is the critical precondition. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 3.3 (Low) is well-supported by the vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N: exploitation requires local device access and active user interaction with a malicious file, with impact limited to UI integrity (URL display spoofing) and no confidentiality or availability consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with local access to an Android device - such as a shared kiosk or a device accessed via physical proximity or malware that has already established file-write capability - places a crafted file on the device. When the victim opens or interacts with that file in Chrome for Android, the Omnibox displays a spoofed URL (e.g., a trusted banking domain) while the browser may be loading attacker-controlled content, creating a phishing opportunity within the browser session. … |
| Remediation | Update Google Chrome on Android to version 151.0.7922.72 or later, which includes the vendor-released patch per the Chrome Releases advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today