EUVD-2026-50664
GHSA-88fx-j87r-pmxf
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
UI spoofing enables limited confidentiality and integrity impact via deception; no availability impact is attributable to this class of flaw.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
UI spoofing in Google Chrome's WebView component on Android (versions prior to 151.0.7922.72) allows a remote attacker to mislead users about the origin or security context of displayed content via a crafted HTML page. Classified by Chromium as Low severity and rooted in CWE-451 (UI Misrepresentation of Critical Information), this flaw could be leveraged to facilitate phishing or social engineering by making malicious content visually indistinguishable from trusted interfaces. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), indicating this is a routine patch-cycle issue rather than an active threat.
Technical ContextAI
WebView is an Android system component - embedded in Google Chrome and many third-party apps - that renders web content within an application context. CWE-451 (User Interface Misrepresentation of Critical Information) describes failures where the UI presents misleading information about the security state, origin, or nature of rendered content, creating a gap between user perception and actual security context. This category typically covers spoofed address bars, fake permission dialogs, or counterfeit security indicators. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome versions, with EUVD-2026-50664 and the Chrome stable channel advisory narrowing the vulnerable range to Chrome for Android below 151.0.7922.72. The Chromium bug tracker reference (issues.chromium.org/issues/506390325) is likely access-restricted, so the precise HTML trigger mechanism is not publicly disclosed.
RemediationAI
Update Google Chrome for Android to version 151.0.7922.72 or later via the Google Play Store; this is the vendor-released patch documented in the stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Organizations managing Android fleets via MDM should push this update through their standard Chrome update policies. As a compensating control prior to patching, restricting end-user navigation to untrusted or unvetted web pages on managed Android devices reduces the attack surface - though this is impractical in most consumer contexts. Enterprise applications that embed Chrome WebView should also update their bundled WebView dependency if it is pinned below this version. No significant operational side effects from applying the standard Chrome update are expected.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today