CVE-2026-84330: UI misrepresentation in Google Chrome

This vulnerability in Google Chrome on Android allows a remote attacker to craft an HTML page that spoofs the browser's address bar when the browser is in fullscreen mode. This UI misrepresentation can deceive users about the legitimacy of the site they are viewing. The issue affects versions prior to 152.0.7977.75. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, low confidentiality impact, no integrity impact, and low availability impact.

An attacker can remotely cause the browser to display a spoofed address bar in fullscreen mode, potentially tricking users into believing they are on a trusted site when they are not. This can facilitate phishing or social engineering attacks. The confidentiality impact is low, with no integrity impact and low availability impact.

A fix is available in Google Chrome version 152.0.7977.75. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation actions are indicated by the vendor advisory.