CVE-2026-84330: Google Chrome for Android vulnerability

Q: What does an attacker need to exploit this issue?

An attacker needs to get a user running a vulnerable version of Chrome for Android to open a crafted HTML page. The issue enables address-bar spoofing through UI misrepresentation in FullScreen mode.

Q: Which Chrome for Android versions are affected?

Chrome for Android versions prior to 152.0.7977.75 are affected. Updating to version 152.0.7977.75 or later addresses the reported vulnerable version range.

Q: Who is realistically exposed?

Users of vulnerable Chrome for Android versions who visit attacker-controlled or otherwise crafted web pages are exposed. Exploitation is remote and does not require the attacker to have local access to the device.

Published Sep 1, 2026

Updated

UI misrepresentation in FullScreen in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)

Affected Software

1 affected component

Google Chrome for Android<152.0.7977.75

Event History

Sep 1, 2026

CVE Published

via MITRE·11:42 PM

Data Sourced

via MITRE·11:42 PM

DescriptionWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs to get a user running a vulnerable version of Chrome for Android to open a crafted HTML page. The issue enables address-bar spoofing through UI misrepresentation in FullScreen mode.

Which Chrome for Android versions are affected?

Chrome for Android versions prior to 152.0.7977.75 are affected. Updating to version 152.0.7977.75 or later addresses the reported vulnerable version range.

Who is realistically exposed?

Users of vulnerable Chrome for Android versions who visit attacker-controlled or otherwise crafted web pages are exposed. Exploitation is remote and does not require the attacker to have local access to the device.