EUVD-2026-69745
GHSA-x22g-vm4q-4224
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Spoofed address bar enables phishing (C:L) and submission of data to attacker-controlled destination (I:L); no availability impact applies to a UI misrepresentation; user must actively visit the page (UI:R).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
UI misrepresentation in FullScreen in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Address bar spoofing in Google Chrome on Android prior to version 152.0.7977.75 allows an unauthenticated remote attacker to deceive users about their true browsing origin by triggering fullscreen mode via a crafted HTML page. The flaw (CWE-451: UI Misrepresentation of Critical Information) causes the address bar to be suppressed or misrepresented during fullscreen transitions, creating a reliable phishing surface on Android devices. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to be using Google Chrome on an Android device running a version prior to 152.0.7977.75 - the vulnerability is explicitly Android-specific and does not affect Chrome on desktop or iOS. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.4 (Medium) score is consistent with a bounded but real threat: the attack is network-reachable and requires no attacker privileges, but demands active user interaction and produces only partial technical impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Google Chrome on Android to version 152.0.7977.75 or later, which contains the vendor-released patch per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today