CVE-2026-102312: UI misrepresentation in Omnibox
UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: High)
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 154.0.8037.92
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-102331
- CVE-2026-102317
- CVE-2026-102313
- CVE-2026-102299
- CVE-2026-102306
- CVE-2026-102307
- CVE-2026-102323
- CVE-2026-102303
- CVE-2026-102311
- CVE-2026-102300
- CVE-2026-102326
- CVE-2026-102316
- CVE-2026-102304
- CVE-2026-102328
- CVE-2026-102309
- CVE-2026-102325
- CVE-2026-102308
- CVE-2026-102301
- CVE-2026-102319
- CVE-2026-102324
- CVE-2026-102318
- CVE-2026-102329
- CVE-2026-102315
- CVE-2026-102302
- CVE-2026-102321
- CVE-2026-102320
- CVE-2026-102310
- CVE-2026-102327
- CVE-2026-102330
- CVE-2026-102314
- CVE-2026-102305
Frequently Asked Questions
Which users are exposed to this issue?
The issue affects Google Chrome on Android before version 154.0.8037.92. A user must visit a crafted HTML page for a remote attacker to attempt address-bar spoofing.
What does an attacker need to exploit it?
The attacker needs to provide or cause the victim to open a crafted HTML page. The supplied information does not indicate that authentication, local access, or additional permissions are required.
Are default Chrome installations affected?
The affected condition is described for Chrome on Android prior to 154.0.8037.92, with no configuration prerequisite stated. Based on the available information, Android installations running an earlier version should be treated as affected.
What can be done if updating is not immediately possible?
No product-specific mitigation is provided. Until Chrome can be updated, users should be cautious when opening untrusted pages, since exploitation relies on a crafted HTML page and can spoof the address bar.