CVE-2026-106338 in Chrome
Summary
by MITRE • 10/07/2026
UI misrepresentation in PictureInPicture in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as UI misrepresentation within the Picture-in-Picture feature of Google Chrome on Android prior to version 155.0.8059.39 represents a significant user interface spoofing risk that undermines the trust model of web browsing. This flaw allows a remote attacker, through the delivery of a specially crafted HTML page, to manipulate the visual presentation of the browser's address bar and navigation controls when content is displayed in Picture-in-Picture mode. By exploiting this discrepancy between the actual URL being loaded and its visual representation on screen, an adversary can create a deceptive interface that misleads users regarding the true origin or security status of the web content they are viewing.
From a technical perspective, this issue stems from improper synchronization or rendering logic within the Chromium engine when handling overlay interfaces for floating video windows. When a webpage triggers Picture-in-Picture mode, the browser is expected to maintain a consistent and accurate display of navigation elements such as the URL bar, lock icon, and security indicators. However, in versions prior to the specified patch, these UI components may fail to update correctly or may be obscured by maliciously styled overlays within the HTML content itself. This allows attackers to inject visual artifacts that mimic legitimate browser chrome while displaying potentially malicious or phishing-related URLs underneath, effectively decoupling what the user sees from what is actually being transmitted over the network.
The operational impact of this vulnerability centers on social engineering and credential theft scenarios. Users relying on visual cues such as padlock icons or domain names to verify site authenticity may be tricked into entering sensitive information like passwords, credit card numbers, or personal identification data on a phishing site that appears legitimate due to the spoofed interface. This type of attack is particularly dangerous because it bypasses traditional security warnings by manipulating the user's perception rather than exploiting cryptographic weaknesses directly. The severity is classified as low within Chromium’s internal metrics primarily because successful exploitation requires specific user interaction and context, but its potential for widespread phishing campaigns remains a serious concern for end-user safety.
This vulnerability aligns with CWE-201: Insertion of Sensitive Information into Sent Data via UI Spoofing, where the system fails to properly separate trusted interface elements from untrusted web content. In terms of offensive security frameworks, it maps closely to MITRE ATT&CK technique T1568.002: Dynamic Resolution, which involves using domain fronting or similar techniques to mask malicious activity, although in this specific case, the masking is visual rather than network-level. It also relates to UI Redressing attacks where attackers trick users into interacting with a different interface than what they perceive on screen.
Mitigation strategies primarily involve updating Google Chrome on Android devices to version 155.0.8059.39 or later, which addresses the rendering logic flaws in the Picture-in-Picture implementation. Users should remain vigilant for any discrepancies between the visual appearance of a website and its actual domain structure, especially when interacting with floating video players. Security awareness training emphasizing the importance of verifying URLs directly from secure system-level indicators rather than relying solely on embedded web elements can further reduce susceptibility to such UI-based attacks. Additionally, enabling strict content security policies and third-party cookie restrictions in browser settings can help limit the ability of malicious scripts to manipulate overlay layers effectively.