EUVD-2026-89375
GHSA-23qg-gx8x-rqr2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page
-
DeliveryLure Android Chrome user to visit
-
ExploitTrigger Omnibox URL misrepresentation
-
ExecutionDisplay spoofed trusted address bar
-
ImpactHarvest credentials via phishing
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security UI security representation
|
| Exploitation Conditions | Exploitation requires the victim to open a crafted HTML page in Google Chrome for Android on a version prior to 154.0.8037.92 (UI:R - user interaction is mandatory). No authentication or special privileges are needed (PR:N), and the attack works remotely over the web against default browser configurations. The practical limiting factors are: the attacker must first entice the target to navigate to the malicious page, the impact is confined to visually misrepresenting the Omnibox/address bar (no data theft or code execution), and only the Android build is affected, so desktop and iOS Chrome users are out of scope. |
| Impact | All signals converge on LOW real-world priority despite the 'High' Chromium severity label. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, base 4.3) describes a network-reachable but user-interaction-dependent issue with no confidentiality or availability impact and only low integrity impact - consistent with an address-bar spoof rather than code execution. CISA's SSVC framework reinforces this: Exploitation=none, Automatable=no, Technical Impact=partial, which maps to a 'Track' (not 'Act') decision. No EPSS score, KEV listing, or public POC was provided, so there is no evidence of active or likely near-term exploitation. Note the tension between the vendor's internal 'High' rating (which reflects browser-security triage conventions for spoofing bugs that facilitate phishing) and the objectively modest CVSS base score - the 'High' label denotes remediation urgency within Chrome's release process, not high real-world risk to a patched fleet. Bottom line: a genuine but low-severity UI-integrity flaw; deploy the vendor update in the normal patch cycle, not as an emergency. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page and lures an Android Chrome user to visit it (e.g., via a link in a message or ad). The page manipulates the Omnibox rendering so the displayed URL does not match the actual origin, letting the attacker present a trusted-looking address bar over attacker-controlled content to support credential phishing or scam delivery. No public exploit was identified at time of analysis, and success requires the victim to actually open the page (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Address-bar spoofing in Google Chrome for Android versions prior to 154.0.8037.92 lets a remote attacker misrepresent the Omnibox (URL bar) to a victim who opens a crafted HTML page, according to Google's own Chromium severity rating of High. The assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, 4.3) confirms this is an unauthenticated, network-reachable attack that hinges entirely on user interaction, with only a low-integrity impact on the browser UI and no confidentiality or availability loss, and the CISA SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: partial) places it at low real-world priority. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the practical limitation is that the attacker must first lure the target to a malicious page, and only the Android build is affected - desktop and iOS Chrome users are out of scope.
RemediationAI
Apply the vendor-released patch: Google Chrome for Android 154.0.8037.92 or later, which Google published via the stable-channel update at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01807488085.html; the fix is tracked upstream at https://issues.chromium.org/issues/551668264. Update through the Google Play Store (or managed Play policies for enterprise fleets) and confirm the installed version, since Android Chrome auto-update can lag on devices with deferred or metered update settings. Because this is a low-severity UI-spoofing issue with no KEV exploitation and no identified public exploit, disabling JavaScript or other aggressive browser hardening is not warranted and would break functionality without meaningful benefit; the compensating control trade-off here is user education - train users to distrust address-bar appearance and to navigate to sensitive sites via bookmarks or typed domains rather than links in unsolicited messages, and layer phishing-resistant MFA and origin-bound password managers so that credentials cannot be harvested even if the spoofed Omnibox is believed. If a device cannot be updated promptly, restricting high-value web activity (banking, SSO portals) away from that device is the most effective short-term mitigation, accepting the operational inconvenience of a secondary managed browser or desktop.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-451 (User Interface (UI) Misrepresentation of Critical Information) and resides in the Omnibox - the combined address and search bar of Chromium-based browsers - specifically in the Android rendering path. The affected component is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, and the impacted build stream is Google Chrome for Android prior to 154.0.8037.92 (tracked by ENISA as EUVD-2026-89375). In effect, crafted HTML can cause the browser chrome to display origin/URL information that does not match the actual loaded document, undermining the primary trust signal users rely on to judge site identity. The attack is purely client-side: the CVSS vector requires no privileges (PR:N) and no authentication, but mandates that the victim voluntarily navigate to attacker-controlled content (UI:R). Because the impact is scored as Integrity:Low with no Confidentiality or Availability effect, this is a UI-trust/phishing-assist defect rather than a memory-corruption or code-execution bug; the SSVC 'Automatable: no' and 'Technical Impact: partial' ratings are consistent with that constrained scope.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Web-delivered spoof needing victim navigation (UI:R), no auth (PR:N); only low integrity impact from address-bar misrepresentation, no confidentiality or availability effect.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB