UI misrepresentation in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to spoof address bar via a crafted HTML page. (CVE-2026-79250)

CVE-2026-79250 describes a UI misrepresentation issue in Google Chrome's navigation system before version 152.0.7977.65. An attacker can exploit this flaw by crafting a malicious HTML page that spoofs the browser's address bar, potentially deceiving users about the legitimacy of the website they are viewing. The vulnerability is classified under CWE-451 (User Interface Misrepresentation). The CVSS v3.1 base score is 5.4, indicating moderate severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, low confidentiality impact, no integrity impact, and low availability impact.

The vulnerability allows remote attackers to spoof the address bar in Google Chrome, which could lead to user deception and phishing attacks by making malicious sites appear legitimate. However, the impact is limited to confidentiality and availability with low severity, and no known exploits are reported in the wild.

A fix is available in Google Chrome version 152.0.7977.65 and later. Users and administrators should update to this version or a later release to remediate the vulnerability. Since this is not a cloud service, manual patching is required. Patch status is confirmed by the version information in the description.