CVE-2026-102312: Address Bar Spoofing via Omnibox UI Misrepresentation in Chrome on Android · ZeroHour

CVE-2026-102312

mass

Address Bar Spoofing via Omnibox UI Misrepresentation in Chrome on Android

CVSS 3.1

4.3 medium

EPSS

—

Published

Sep 29, 2026 (1d ago)

Modified

Sep 30, 2026

AI analysis

CVE-2026-102312 is a UI misrepresentation flaw (CWE-451) in the Omnibox, Google Chrome's address bar, on Android. A remote attacker can trigger it simply by luring a victim to a crafted HTML page, which causes the browser to display a spoofed or incorrect URL in the address bar. Because users rely on the address bar to verify they are on a legitimate site, this enables convincing phishing and credential or payment theft even against users who would otherwise check the URL. Only Chrome on Android builds prior to 154.0.8037.92 are affected; the flaw is rated High severity by Chromium and was fixed in the Chrome 154 stable update that resolved 32 security issues in total. No public proof of concept is known, it is not on the CISA KEV list, and no active exploitation has been reported.

What to do: Update Chrome on Android to 154.0.8037.92 or later immediately — open Chrome > Settings > About Chrome (or navigate to chrome://settings/help) to confirm the version, since Play Store auto-updates can take days to reach all devices. Enterprise and mobile-fleet admins should verify minimum browser versions via MDM policy and push the update. Until patched, users should treat unexpected login or payment prompts with suspicion, since the address bar on a vulnerable device cannot be trusted to show the true origin.

Affected

Google Chrome for Android

prior to 154.0.8037.92 (fixed in 154.0.8037.92)

Estimated exposure

mass≈2 billion+ users (Chrome is the preinstalled default browser on roughly 3 billion active Android devices) — Estimated from Google's publicly reported ~3 billion active Android devices and Chrome's dominant mobile browser share, tempered by the fact that Google Play auto-updates typically patch the fleet within days of release.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: High)

Vendors: google
Products: chrome
Weakness: CWE-451
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-102312

In the news1 stories

Google Chrome 154 Update Fixes 32 Security Flaws Including Critical ANGLE Bug