CVE-2026-106317 in Chrome
Summary
by MITRE • 10/06/2026
UI misrepresentation in FullScreen in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as UI misrepresentation in the full-screen mode of Google Chrome for Android, specifically affecting versions prior to 155.0.8059.39, represents a significant trust boundary violation within the browser's user interface layer. This flaw allows a remote attacker to manipulate the visual presentation of the address bar and navigation controls when a webpage is rendered in full-screen mode. By crafting an HTML page with specific CSS or JavaScript techniques that exploit how Chrome handles viewport metrics and overlay positioning during full-screen transitions, an adversary can cause the browser's chrome elements, such as the URL display or back button, to be obscured, displaced, or visually duplicated by malicious content. This creates a deceptive user interface where the legitimate security indicators are hidden behind attacker-controlled overlays, effectively breaking the visual contract between the browser and its user regarding which domain is currently active.
From a technical perspective, this issue stems from improper handling of z-index stacking contexts and viewport boundaries in the rendering engine when full-screen APIs are invoked on Android devices. The Chromium team classified this with a Low security severity because it does not directly lead to code execution or data exfiltration through traditional exploitation vectors like buffer overflows or sandbox escapes. However, its impact is profound from a social engineering standpoint. When users interact with a web application in full-screen mode, they often rely on the visible address bar as their primary cue for verifying the legitimacy of the site. If an attacker can overlay malicious content over this area, they can make a phishing page appear to be a legitimate service or hide critical security warnings that would normally alert the user to potential risks.
The operational impact of this vulnerability is primarily centered around credential theft and session hijacking via sophisticated phishing attacks. An attacker could host a crafted HTML page on a malicious server and lure users into visiting it, perhaps through a link in an email or social media post. Once the user enters full-screen mode, either manually or automatically depending on the site's design, the UI spoofing technique activates. The user might believe they are interacting with a trusted banking portal or login service because the address bar is obscured by a convincing replica of that interface. This deception lowers the psychological barrier for users to submit sensitive information such as usernames, passwords, and two-factor authentication codes directly into fields controlled by the attacker rather than the actual domain's form handlers.
This vulnerability aligns closely with CWE-201: Insertion of Sensitive Information Into Sent Data if it leads to credential capture, but more accurately maps to CWE-443: Description of UI as Trustworthy and CWE-798: Use of Hard-coded Credentials in the context of phishing simulations. In terms of offensive security frameworks, this technique is a classic implementation of ATT&CK T1621: Multi-Factor Authentication Interception or more broadly ATT&CK T1534: Internal Spearphishing when used within enterprise environments to trick employees into accessing fake internal portals. The core mechanism relies on UI redressing, where the attacker tricks the user into interacting with a malicious interface that mimics a trusted one, exploiting human trust in visual cues rather than technical security controls.
Mitigation for this vulnerability was addressed by Google in Chrome version 155.0.8059.39 and subsequent releases through updates to the rendering engine's handling of full-screen overlays and z-index management on Android. Users are strongly advised to update their browsers immediately to ensure these UI spoofing techniques cannot be executed against them. Beyond software updates, security awareness training remains critical for end-users. Individuals should be educated to verify domain names even when using full-screen modes by checking system-level indicators such as the device's status bar or notification shade which remain outside the browser's control and are less susceptible to web-based UI manipulation. Additionally, enabling strict content security policies on websites can help prevent certain types of overlay attacks, although this does not fully mitigate client-side rendering flaws in older browsers.