EUVD-2026-50890
GHSA-whg4-p9v6-fwjh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts crafted HTML page
-
DeliveryVictim receives phishing link targeting Android Chrome
-
ExploitVictim clicks link and navigates to attacker page
-
ExecutionChrome renders incorrect security UI indicators
-
PersistVictim is deceived into trusting spoofed domain
-
ImpactVictim submits credentials or sensitive data to attacker
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security UI security representation
|
| Exploitation Conditions | The victim must be using Google Chrome on Android running a version prior to 151.0.7922.72 - this flaw does not affect desktop Chrome or other mobile browsers. The attack requires the victim to actively navigate to an attacker-controlled URL (UI:R in CVSS), meaning at least one user click or navigation action is necessary; drive-by exploitation without user interaction is not possible. No authentication, special server-side configuration, or non-default browser settings are required on the attacker's side. Exploitation is platform-constrained to Android and is further limited by the non-automatable nature of the attack (SSVC: Automatable: no), ruling out mass-scale scripted targeting. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N scores 4.3 (Medium), reflecting that while the attack is network-reachable and requires no attacker privileges or special configuration, it mandates user interaction and delivers only a low integrity impact with no confidentiality or availability consequences. EPSS at 0.17% (7th percentile) signals very low real-world exploitation probability, corroborated by SSVC's 'exploitation: none' status and 'automatable: no' assessment. The absence of any public POC and non-inclusion in CISA KEV further reduce urgency. The practical risk is that users on unpatched Android Chrome could be deceived into trusting spoofed sites, but this requires social engineering to deliver the initial click. This is a real-but-low-priority issue - patch during normal update cycles rather than as an emergency response. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page designed to trigger Chrome's incorrect security UI rendering on Android devices, then delivers a link via phishing SMS, email, or social media to induce the victim to navigate to it. Once the victim opens the page in an unpatched Android Chrome, the browser displays misleading domain or security indicator information, causing the victim to believe they are on a trusted site such as their bank or identity provider. No public exploit code is currently known for this vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Domain spoofing in Google Chrome on Android (prior to 151.0.7922.72) enables remote unauthenticated attackers to present misleading security UI indicators to users via a crafted HTML page. The flaw stems from CWE-451 - user interface misrepresentation of critical information - where Chrome's Android UI fails to accurately convey the true origin or domain of the page being visited. No public exploit code exists, EPSS sits at 0.17% (7th percentile), and SSVC confirms exploitation status as none, collectively indicating low urgency despite the broad user base.
RemediationAI
Update Google Chrome on Android to version 151.0.7922.72 or later, as documented in the Chrome stable channel advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome on Android typically auto-updates via the Google Play Store, but administrators managing enterprise Android fleets should verify deployment via MDM policy. No formal workaround is documented by the vendor. While awaiting patch rollout, organizations may advise users to verify destination URLs through alternative means before entering credentials - for example, using bookmarks for sensitive sites rather than following links - though this is a behavioral control with no enforcement mechanism and should not substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-451 describes a class of vulnerabilities where security-critical UI elements - such as address bar domain display, lock icon rendering, or SSL indicator behavior - are rendered inaccurately, misleading the user about the true origin of content. On Android, Chrome's compact UI and limited screen real estate create additional surface for origin-confusion bugs compared to desktop variants. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome versions on the Android platform prior to 151.0.7922.72. The Chromium project independently rated this Low severity, consistent with the integrity-only CVSS impact. The root cause is in Chrome's security UI rendering layer rather than in the network stack or content isolation mechanisms.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network-delivered UI spoofing requiring one user click; integrity-only impact limited to misleading security indicator display with no data exposure or service disruption.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Incorrect security UI in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome 151 Security Vulnerabilities
View all 80Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB