Google Chrome Android EUVD-2026-50925

Exploitation requires the target device to be running Google Chrome on Android (not desktop, iOS, or ChromeOS) at a version prior to 151.0.7922.72. The victim must actively interact with a crafted HTML page - passive loading alone is insufficient given the UI:R requirement in the CVSS vector; some user gesture or engagement is necessary to trigger PiP. The PictureInPicture API must be invocable by the attacker's page, which is generally permitted in Chrome without special user grants. No authentication is required from the attacker (PR:N). The outcome is limited to domain spoofing in the browser UI; no code is executed and no data is directly exfiltrated by the vulnerability itself, meaning harm requires follow-on attacker action such as presenting a credential-harvesting form under the spoofed origin.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N scores 6.5 (Medium), reflecting a remotely reachable flaw requiring no authentication or elevated privileges, but demanding user interaction. The I:H rating is notable but must be interpreted in context: the integrity impact is confined to browser UI spoofing - not filesystem writes, not privilege escalation. The vendor-assigned AC:L is arguably optimistic for a race condition; winning a race reliably typically implies AC:H in independent assessment. EPSS at 0.16% (6th percentile) strongly supports treating this as low-probability exploitation at scale. No KEV listing and no public exploit code further reduce urgency. Taken together, these signals indicate a real but low-priority vulnerability: meaningful enough to patch in the next update cycle, but not warranting emergency response or compensating controls ahead of the patch.

An attacker sends a phishing link to an Android user, directing them to a crafted HTML page that programmatically triggers PictureInPicture on a video element. By exploiting the race condition during PiP activation or origin handoff, the attacker causes Chrome's UI to display a spoofed domain - such as a bank or identity provider - in the trust indicator while actually serving attacker-controlled content. The victim, trusting the spoofed domain, submits credentials that are harvested by the attacker. No public exploit code has been identified at the time of analysis.