CVE-2022-0804 in Edge
Summary
by MITRE • 04/05/2022
Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 99.0.4844.51 allowed a remote attacker to hide the contents of the Omnibox (URL bar) via a crafted HTML page.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/24/2026
This vulnerability represents a critical user interface deception flaw that exploited the full screen mode implementation in google chrome for android. The issue stemmed from an inadequate handling of visual elements during fullscreen transitions, specifically affecting how the omnibox url bar was rendered when users navigated to full screen mode. Attackers could craft malicious html pages that would manipulate the display behavior to conceal the address bar contents, making it appear as though they were browsing a legitimate website while actually being redirected to malicious destinations.
The technical implementation flaw occurred within chrome's android browser engine where the fullscreen api did not properly maintain visibility of the omnibox during screen transitions. This allowed attackers to exploit the interface rendering logic by constructing html pages that would trigger fullscreen mode while simultaneously manipulating the visual hierarchy to hide the url bar from view. The vulnerability specifically affected versions prior to 99.0.4844.51 where proper security boundaries between user interface elements were not maintained during fullscreen operations.
The operational impact of this vulnerability was significant as it enabled sophisticated phishing attacks and credential theft operations. Users would be unable to verify the actual destination of their navigation since the url bar contents were concealed, making it impossible to detect when they had been redirected to malicious sites. This created a false sense of security that attackers could exploit to harvest sensitive information, particularly when combined with other social engineering techniques or when users were conducting financial transactions.
This vulnerability maps directly to CWE-601 and CWE-807, representing open redirect vulnerabilities and insecure direct object references respectively within the context of user interface manipulation. The attack pattern aligns with ATT&CK technique T1531 which involves creating false user interfaces to deceive victims. The flaw also demonstrates poor separation of concerns in ui rendering where security-critical elements were not properly protected from manipulation by untrusted content.
Mitigation strategies included immediate browser updates to version 99.0.4844.51 or later, which implemented proper handling of omnibox visibility during fullscreen mode transitions. Additionally, users should maintain updated browser versions and employ multi-factor authentication for sensitive transactions. Security teams should monitor for similar ui manipulation patterns in other browser components and implement automated scanning for such vulnerabilities in web applications. Organizations may also consider implementing additional browser security extensions that provide enhanced ui visibility monitoring to detect and prevent such deceptive behaviors. The fix involved strengthening the interface rendering logic to ensure that critical user interface elements remain visible regardless of fullscreen state changes or page manipulation attempts by malicious content.