CVE-2026-95321 in Chrome
Summary
by MITRE • 09/29/2026
UI misrepresentation in Payments in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified as a user interface misrepresentation within the payment processing subsystem of Google Chrome on Android, specifically affecting versions prior to 154.0.8037.57, represents a significant risk related to trust and integrity in web-based transactions. This flaw allows a remote attacker to manipulate or spoof UI elements through the delivery of a specially crafted HTML page. The core technical issue lies in how the browser renders payment-related interfaces, where an adversary can inject deceptive visual components that mimic legitimate payment prompts from trusted financial institutions or e-commerce platforms. By exploiting this discrepancy between the actual underlying transaction data and its visual representation, attackers can create phishing scenarios that are far more convincing than traditional text-based lures because they leverage the browser's own rendering engine to display authoritative-looking interfaces.
From a technical perspective, this vulnerability falls under the category of UI redressing or clickjacking variants where the attacker controls the presentation layer without necessarily compromising the underlying application logic directly. The Chromium security team classified this issue with a medium severity rating, indicating that while it requires user interaction and specific conditions to be successful, its potential for widespread exploitation in financial contexts warrants immediate attention. Attackers can host malicious web pages on compromised or rogue websites that load silently in the background or via social engineering tactics such as email links or QR codes. When a victim interacts with these spoofed elements believing they are part of a legitimate checkout process, sensitive information such as credit card numbers, expiration dates, and security codes may be transmitted to attacker-controlled servers rather than the intended payment processor.
The operational impact of this vulnerability is severe due to its direct association with financial data exfiltration. Users who rely on Chrome for mobile payments are particularly vulnerable because they often have saved payment credentials that make transactions seamless but also increase the value of stolen data. The ability to spoof UI elements undermines the fundamental security principle of user awareness, where users typically verify the domain and visual cues before entering sensitive information. If a malicious page can successfully mimic the appearance of a trusted entity within the browser's own interface context, it bypasses many traditional phishing detection mechanisms that rely on URL inspection or certificate validation alone. This leads to potential financial loss for victims and reputational damage for entities whose branding is impersonated in these spoofed interfaces.
Mitigation strategies primarily involve updating the Chrome application to version 154.0.8037.57 or later, which contains patches addressing this rendering flaw. Users should ensure that automatic updates are enabled on their Android devices to receive security fixes promptly. Additionally, organizations and individuals can employ additional layers of defense such as multi-factor authentication for payment accounts, which reduces the utility of stolen card details even if they are compromised through UI spoofing. Security awareness training remains critical, emphasizing the importance of verifying transaction details beyond just visual appearance, including checking domain names in address bars and being cautious of unexpected prompts on mobile devices. Industry standards like CWE-201, which covers insertion of sensitive information into an unintended info channel, provide a framework for understanding this type of vulnerability, while ATT&CK techniques related to credential harvesting via UI redressing highlight the tactical approach used by adversaries exploiting such flaws.