Description

UI misrepresentation in FullScreen in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-02T00:18:29.523Z",
  "pubdate": "2026-09-02T00:18:29.523Z",
  "executiveSummary": "A UI misrepresentation vulnerability exists in Google Chrome prior to version 152.0.7977.75, specifically related to the browser's FullScreen mode implementation.\nThis vulnerability is classified as an address bar spoofing flaw, where a remote attacker can manipulate the visual representation of the browser's URL navigation interface.\nBy leveraging a specially crafted HTML page, an attacker can deceive users into believing they are interacting with a legitimate, trusted domain while they are actually viewing malicious or deceptive content.\nThe risk implication is significant as it facilitates sophisticated phishing and credential theft operations by subverting the user's ability to verify the site's origin.\nThe attack requires no authentication or special privileges on the client system; however, it necessitates user interaction, specifically the victim navigating to the attacker-controlled page and potentially triggering a FullScreen state.\nGiven that the address bar is the primary trust indicator for web navigation, its subversion represents a critical failure in the browser's security boundary.",
  "technicalDetails": "The vulnerability resides within the Chromium browser's UI rendering pipeline, specifically concerning how the browser interface updates and renders the address bar location during state transitions into FullScreen mode.\nIn standard browser operation, the address bar serves as a security-critical component that provides an authoritative source of truth for the origin of the currently displayed document. When the browser enters FullScreen mode, the UI is typically hidden or consolidated to maximize screen real estate.\nThe root cause of this vulnerability involves a failure in the browser's internal logic to correctly sanitize or reset UI state indicators when transitioning from a normal window state to a FullScreen presentation state. An attacker can exploit this by injecting HTML/JavaScript that triggers a FullScreen request while simultaneously manipulating the document's visible content to mimic the browser's native UI chrome.\nThe attack flow proceeds as follows: First, the attacker directs a user to a malicious domain. Second, the page initiates a FullScreen request via the Fullscreen API. Third, during the transition, the attacker uses the crafted HTML to overlay a fake address bar that appears consistent with the user's expected browser interface. Fourth, due to the flaw in the browser's UI synchronization, the malicious overlay persists while the browser fails to render or update the genuine address bar, or renders it in a way that is indistinguishable from the attacker's mock UI.\nThe payload behaves by rendering a deceptive visual representation of a high-value target site (e.g., a banking login or enterprise SSO page). Because the legitimate address bar is suppressed or improperly rendered during the transition, the user is deprived of the visual context needed to verify that the origin URL remains that of the attacker's server rather than the target brand.\nThis vulnerability effectively bypasses the browser's same-origin policy protections regarding visual trust. Post-exploitation, the attacker can solicit sensitive user input—such as passwords, tokens, or personal identifiers—within a context the user assumes to be authenticated and secure. The impact is primarily focused on social engineering and credential harvesting, as the underlying sandbox remains intact, but the user-facing security indicators are effectively nullified."
}