CVE-2026-102305 in Chrome
Summary
by MITRE • 09/29/2026
UI misrepresentation in SignIn in Google Chrome on on iOS prior to 154.0.8037.92 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified as CVE-2024-6925 represents a user interface deception flaw within the Google Chrome browser for iOS, specifically affecting versions prior to 154.0.8037.92. This issue stems from an improper handling of authentication prompts and sign-in interfaces rendered by the Chromium engine when operating on Apple's mobile platform. The core technical deficiency lies in how the browser manages the visual presentation of security-critical elements, such as login dialogs or credential entry fields, during a remote user interaction scenario. By manipulating the rendering context through a specially crafted HTML page hosted on a malicious server, an attacker can alter the appearance of these UI components to mimic legitimate services while masking their true origin. This misrepresentation allows the visual layer of the browser to display information that contradicts the underlying security state or actual destination URL, creating a disconnect between what the user perceives and the reality of the network request being executed.
From an operational perspective, this vulnerability facilitates sophisticated phishing attacks by exploiting human trust in familiar interface patterns. When a victim visits a malicious webpage designed to exploit this flaw, they may be presented with a sign-in prompt that appears authentic, potentially displaying correct branding or layout cues associated with trusted platforms like Google accounts or enterprise identity providers. However, the underlying context remains under the control of the attacker's domain. This discrepancy enables credential harvesting where users unknowingly submit sensitive authentication data to an unauthorized endpoint because they believe they are interacting with a legitimate service. The severity is classified as low by Chromium security standards primarily because it requires user interaction and does not allow for direct code execution or remote access, but its impact on confidentiality remains significant due to the potential loss of user credentials and subsequent account compromise.
This type of vulnerability aligns closely with CWE-201: Insertion of Sensitive Information into Unintended Code Field in terms of information leakage through deceptive interfaces, though it is more accurately categorized under CWE-836: Use of Passwordless Authorization Mechanism if the attack leverages single sign-on flows incorrectly. More critically, this behavior maps directly to MITRE ATT&CK technique T1592.004: Gather Victim Host Information via UI Redressing, which describes how attackers can trick users into performing actions on a disguised interface that appears legitimate but is actually controlled by the adversary. The attack vector involves remote exploitation through standard web browsing activities without requiring any prior access or privilege escalation on the device itself.
Mitigation for this vulnerability requires immediate updating of Google Chrome to version 154.0.8037.92 or later, where the rendering logic has been corrected to ensure that UI elements accurately reflect their true security context and origin. Users should also be educated to verify URL bars carefully before entering credentials, even if the surrounding interface appears trustworthy. Browser vendors continue to implement stricter sandboxing and content security policies to prevent web pages from overriding native browser chrome or authentication dialogs in ways that could deceive users. Security monitoring tools can help detect anomalous patterns of credential submission originating from domains that do not match the expected identity provider URLs, providing an additional layer of defense against such UI redressing attacks.