CVE-2026-121165 in Chrome
Summary
by MITRE • 11/03/2026
UI misrepresentation in Mobile in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified as a user interface misrepresentation in Google Chrome for Android, specifically affecting versions prior to 157.0.8103.38, represents a significant risk related to trust and identity verification within the browser environment. This flaw allows an attacker who controls or influences a remote web page to manipulate how certain UI elements are rendered on the device screen. By leveraging social engineering techniques, such as presenting a deceptive landing page that mimics legitimate banking or authentication interfaces, an adversary can trick users into interacting with spoofed content. The core issue lies in the browser's failure to correctly enforce visual boundaries or contextual cues that distinguish official chrome-controlled UI from web-content-driven elements, thereby creating ambiguity for the end-user regarding which entity is actually requesting sensitive information or actions.
From a technical perspective, this vulnerability exploits weaknesses in how the rendering engine handles overlaying and positioning of interface components relative to native browser controls like address bars, security indicators, or permission prompts. When a crafted HTML page utilizes specific CSS properties, JavaScript DOM manipulations, or iframe injection techniques, it can visually obscure critical security warnings or make malicious buttons appear as part of the trusted chrome UI layer. This misrepresentation breaks the chain of trust that users rely on to verify they are interacting with a legitimate service rather than a phishing site. The severity is classified as low by Chromium standards because it does not allow for direct code execution, memory corruption, or privilege escalation within the browser sandbox itself; however, its impact is amplified by the high likelihood of user interaction due to the deceptive nature of the attack vector.
The operational impact of this vulnerability centers on successful phishing campaigns and credential theft. An attacker can craft a malicious webpage that displays a fake login form indistinguishable from a real one, potentially hiding the actual URL or security certificate details behind transparent overlays or misaligned elements. Users who are not sufficiently vigilant may enter their usernames, passwords, or two-factor authentication codes into this spoofed interface, believing they are on a secure and legitimate site. This leads to unauthorized access to personal accounts, financial loss, and potential compromise of downstream systems if those credentials are reused elsewhere. The reliance on social engineering means that the success rate is heavily dependent on user awareness, but even small percentages of successful deception can result in significant data breaches for targeted organizations or individuals.
Mitigation strategies primarily involve updating the browser to version 157.0.8103.38 or later, where these rendering inconsistencies and UI spoofing vectors have been addressed by Google’s security team. Users should ensure that automatic updates are enabled to receive patches promptly as they become available. In addition to software remediation, organizational security policies should enforce the use of approved browsers with up-to-date versions across all mobile devices used for business or sensitive personal activities. Security awareness training is also critical; users must be educated to verify URLs manually by checking the address bar rather than relying solely on visual cues provided within the webpage content itself. Furthermore, enabling multi-factor authentication using hardware keys or app-based tokens that are resistant to phishing can provide an additional layer of defense against credential theft resulting from such UI manipulation attacks.
This vulnerability aligns with CWE-201: Insertion of Sensitive Information into Unintended Code Field and CWE-798: Use of Hard-coded Credentials in the context of deceptive interfaces, though more accurately it falls under CWE-443: Description of Web Interface Misrepresentation which covers scenarios where a web interface is designed to mislead users about its true nature. In terms of offensive security frameworks, this technique maps directly to MITRE ATT&CK tactic T1566.002: Phishing: Spearphishing Attachment or Link variants that utilize UI redressing techniques. The attack relies on the psychological principle of authority and consistency, where users assume that if an interface looks like a trusted brand, it must be safe. Addressing this requires both technical fixes in browser rendering engines and continuous human-centric security education to recognize subtle discrepancies between expected and actual user interfaces.