CVE-2026-84356 in Chrome
Summary
by MITRE • 09/02/2026
UI misrepresentation in FullScreen in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified as UI misrepresentation within the full-screen mode of Google Chrome, specifically affecting versions prior to 152.0.7977.75, represents a significant trust boundary violation that exploits user interface deception techniques. This flaw allows a remote attacker to manipulate the visual presentation of the browser's address bar and navigation controls when a webpage is rendered in full-screen mode. By crafting an HTML page with specific CSS properties or JavaScript manipulations, an adversary can overlay fake UI elements on top of the legitimate browser chrome or alter the appearance of the actual address bar to display a deceptive URL. This technique effectively decouples the visual representation of the site identity from its actual network location, creating a scenario where the user perceives they are interacting with one domain while being directed toward another entirely different destination.
From a technical perspective, this vulnerability leverages the browser's rendering engine behavior in full-screen contexts to bypass standard security indicators that users rely upon for authentication and trust verification. In normal browsing sessions, users check the address bar to confirm the legitimacy of a website before entering sensitive information such as passwords or credit card details. However, when an attacker successfully exploits this UI misrepresentation, they can make a malicious phishing site appear identical to a trusted target in terms of visual layout and URL display. The flaw likely stems from improper handling of z-index layering, pointer events, or full-screen API permissions that allow external content to obscure or mimic native browser controls without triggering standard security warnings associated with mixed content or certificate mismatches.
The operational impact of this vulnerability is primarily centered around social engineering and phishing attacks. By spoofing the address bar, attackers can significantly increase the success rate of credential harvesting campaigns because victims are less likely to suspect deception when the visual cues align perfectly with their expectations. This undermines a fundamental security control mechanism: user awareness of domain identity. Even if technical safeguards like HTTPS certificates are present on both the legitimate and malicious sites, the UI spoofing creates ambiguity that can confuse even vigilant users. The severity is classified as low by Chromium standards because it requires specific conditions such as full-screen mode activation and does not directly allow code execution or data exfiltration without further user interaction, yet its potential for widespread abuse in targeted phishing operations remains high due to the psychological impact of visual deception.
To mitigate this risk, users are strongly advised to upgrade Google Chrome immediately to version 152.0.7977.75 or later, where these rendering inconsistencies have been addressed by patching the underlying UI handling logic. Security administrators should enforce automatic update policies across all endpoints to ensure that patches for browser vulnerabilities are applied promptly upon release. Additionally, users can adopt defensive habits such as manually verifying URLs in a separate context rather than relying solely on full-screen views and being cautious of pages that request full-screen privileges unexpectedly. From an organizational standpoint, implementing web application firewalls with anti-phishing capabilities and conducting regular security awareness training focused on recognizing UI-based deception tactics can further reduce the likelihood of successful exploitation by end-users who may fall victim to such sophisticated social engineering attacks.