CVE-2026-102312: Google Chrome vulnerability
UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: High)
Affected Software
Event History
Frequently Asked Questions
Which users are exposed to this issue?
The issue affects Google Chrome on Android before version 154.0.8037.92. A user must visit a crafted HTML page for a remote attacker to attempt address-bar spoofing.
What does an attacker need to exploit it?
The attacker needs to provide or cause the victim to open a crafted HTML page. The supplied information does not indicate that authentication, local access, or additional permissions are required.
Are default Chrome installations affected?
The affected condition is described for Chrome on Android prior to 154.0.8037.92, with no configuration prerequisite stated. Based on the available information, Android installations running an earlier version should be treated as affected.
What can be done if updating is not immediately possible?
No product-specific mitigation is provided. Until Chrome can be updated, users should be cautious when opening untrusted pages, since exploitation relies on a crafted HTML page and can spoof the address bar.