UI misrepresentation in FullScreen in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page. (CVE-2026-84356)

The vulnerability (CVE-2026-84356) involves UI misrepresentation in Google Chrome's FullScreen mode, enabling a remote attacker to spoof the browser's address bar via a crafted HTML page. This could potentially mislead users about the actual URL they are visiting. The issue is categorized under CWE-451 (Incorrect Resolution of UI Feedback). The vulnerability affects Google Chrome versions prior to 152.0.7977.75. No CVSS score is available, and no known exploits have been reported.

An attacker could use this vulnerability to present a spoofed address bar in FullScreen mode, potentially deceiving users about the legitimacy of the website they are viewing. This could facilitate phishing or social engineering attacks by making malicious sites appear trustworthy. However, the Chromium security team rates this vulnerability as low severity, indicating limited impact or exploitability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users and administrators should update Google Chrome to version 152.0.7977.75 or later once available to address this issue. Until then, caution is advised when using FullScreen mode with untrusted content.