Description

UI misrepresentation in FullScreen in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-02T00:18:27.870Z",
  "pubdate": "2026-09-02T00:18:27.870Z",
  "executiveSummary": "A UI misrepresentation vulnerability exists in Google Chrome for Android due to improper handling of the address bar during fullscreen transitions.\nThe vulnerability is classified as an address bar spoofing flaw, allowing a remote attacker to deceive users by presenting a counterfeit UI that mimics a legitimate website or system interface.\nThis issue affects Google Chrome on Android versions prior to 152.0.7977.75.\nExploitation requires the victim to navigate to a specifically crafted HTML page designed to trigger the browser's fullscreen mode incorrectly.\nThe risk implication is significant as it facilitates sophisticated phishing attacks, credential harvesting, and social engineering, as the victim may believe they are interacting with a trusted domain while browsing malicious content.\nNo special authentication or elevated privileges are required for an attacker to initiate this exploit; the attack is triggered entirely through standard web browser interaction.",
  "technicalDetails": "The vulnerability resides within the Chromium browser engine's UI state management logic, specifically concerning the rendering and visibility synchronization of the address bar during Fullscreen API transitions.\nWhen a web application requests fullscreen mode via the Fullscreen API, the browser is expected to transition the viewport while maintaining security indicators to ensure the user retains context of their current location. In vulnerable versions of Chrome for Android, the implementation failed to correctly enforce the presence of the omnibox or failed to synchronize the transition state, allowing the layout to persist or overwrite the expected UI elements.\nThe attack flow commences when a remote attacker hosts a crafted HTML page. Upon loading the page, the attacker uses JavaScript to invoke the Fullscreen API. Due to the logic error in the browser's display controller, the browser fails to correctly reset or render the persistent address bar elements.\nBy manipulating the DOM and leveraging CSS overlays, the attacker can draw content that visually replaces the missing or misrepresented address bar. This creates a high-fidelity spoof of a legitimate URL bar, effectively deceiving the user regarding the identity of the origin currently rendering content in the viewport.\nThe root cause is a failure in the browser's UI state consistency check between the transition to fullscreen and the subsequent rendering loop. The browser component responsible for the 'browser chrome' (the navigation toolbar) does not receive the necessary update signals to force-render the URL bar when the viewport is restricted, or it allows the viewport content to bleed into the reserved system UI space.\nBecause the spoofed UI appears within the chrome-controlled browser space, it bypasses standard visual indicators that users rely on to verify security. An attacker can use this to overlay malicious input forms that appear to be part of the host browser's identity-verification process, leading to successful credential theft or malicious script execution in an apparent trusted context.\nThis vulnerability is mitigated in version 152.0.7977.75, where the browser engine ensures that the omnibox UI state is explicitly reconciled and re-validated immediately upon triggering fullscreen transitions."
}