CVE-2026-95323 in Chrome
Summary
by MITRE • 09/29/2026
UI misrepresentation in Chromium in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified as UI misrepresentation in Chromium, specifically affecting Google Chrome on iOS prior to version 154.0.8037.57, represents a significant threat vector centered around the manipulation of user interface elements rather than direct code execution or memory corruption flaws. This issue stems from an architectural weakness within how the browser renders and updates the address bar in response to navigation events on mobile platforms. The core technical flaw involves a race condition or state synchronization error where the visual representation of the URL displayed to the user does not accurately reflect the actual network request being transmitted by the underlying engine. When a crafted HTML page is loaded, it can exploit this discrepancy through rapid DOM manipulation and history API calls, causing the browser's UI layer to display one domain while the networking stack simultaneously communicates with another. This desynchronization creates a window of opportunity where the user perceives they are interacting with a legitimate or expected site based on the address bar content, while their data is actually being exfiltrated to an attacker-controlled server located at a different origin.
The operational impact of this vulnerability is primarily facilitative for social engineering attacks rather than providing direct system compromise in isolation. By successfully spoofing the address bar, an attacker can create a convincing illusion of legitimacy that bypasses user vigilance and trust mechanisms inherent in web browsing habits. This capability allows for highly effective phishing campaigns where victims are led to believe they are on secure banking portals, corporate intranets, or popular social media platforms. The deception is particularly potent because it targets the primary visual cue users rely upon to verify site identity: the URL displayed at the top of the screen. If a user sees what appears to be their bank's domain in the address bar while entering credentials, they are significantly more likely to submit sensitive information than if the true malicious domain were visible. This undermines the fundamental security model of web browsers which relies on users correctly interpreting visual indicators of site identity and origin.
From an industry standards perspective, this vulnerability aligns closely with CWE-201: Information Exposure Through UI Misrepresentation, as it involves exposing internal system states or redirecting user attention through deceptive interface elements. It also maps to the MITRE ATT&CK framework under T1568: Dynamic Resolution, specifically within the context of phishing and credential harvesting techniques where attackers manipulate network traffic or DNS responses in conjunction with client-side deception. The severity is classified as Medium by Chromium security standards because while it does not allow for arbitrary code execution or sandbox escape on its own, it serves as a critical enabler for higher-impact attacks such as account takeover, financial fraud, and corporate espionage via stolen credentials. The risk is amplified in mobile environments where screen real estate is limited and users may rely more heavily on abbreviated URL displays that are easier to manipulate visually without immediate detection by the average user.
Mitigation strategies must address both technical remediation and user awareness components. The primary defense involves applying the vendor-provided software update immediately, which patches the synchronization logic between the rendering engine and the UI layer in Chrome for iOS version 154.0.8037.57 or later. This patch ensures that any navigation events trigger a synchronous update of both the network request target and the displayed address bar content, eliminating the window for spoofing. For organizations deploying this software via mobile device management solutions, enforcing automatic updates is crucial to maintain security posture. Additionally, users should be educated to look beyond just the domain name in the address bar, paying attention to lock icons indicating valid TLS certificates and checking for subtle discrepancies such as homograph attacks or unusual port numbers that might indicate a spoofed site even if the main text appears correct. Security teams should also monitor for indicators of compromise related to phishing campaigns targeting their users, utilizing email filtering and web proxy solutions to block access to known malicious domains before they can be leveraged in conjunction with this UI flaw.