CVE-2026-95337 in Chrome
Summary
by MITRE • 09/29/2026
UI misrepresentation in Messages in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified as CVE-2024-6984 represents a user interface deception flaw within the Google Chrome browser for Android, specifically affecting versions prior to 154.0.8037.57. This issue stems from an improper handling of web content rendering that allows crafted HTML pages to manipulate how UI elements are displayed or interpreted by the end-user. The core technical deficiency lies in the browser's ability to be tricked into presenting information in a manner that diverges significantly from its actual state, thereby creating a discrepancy between what is visually presented and the underlying reality of the web page content. This type of flaw falls squarely under the category of UI Redressing attacks, which are formally classified by the Common Weakness Enumeration (CWE) as CWE-1021 Improper Restriction of Rendered UI Layers or Frames. By exploiting this misrepresentation, an attacker can overlay deceptive elements onto legitimate browser interfaces or alter the visual context in which a user interacts with web content, effectively masking malicious intent behind seemingly benign or trusted visuals.
The operational impact of this vulnerability is primarily centered around social engineering and phishing campaigns rather than direct system compromise or data exfiltration through technical exploitation alone. Because the attack vector requires a remote attacker to leverage social engineering, the success of the exploit depends heavily on user interaction and perception. An adversary can craft a malicious HTML page that tricks users into believing they are interacting with a trusted domain or performing a safe action when, in reality, they may be submitting sensitive credentials, clicking deceptive buttons, or navigating away from secure contexts without realizing it. This undermines the fundamental trust model of web browsing, where users rely on visual cues such as address bars, security indicators, and button labels to make informed decisions about their online activities. The severity is rated as Medium by Chromium because while it does not allow for arbitrary code execution or sandbox escape, it poses a significant risk to user safety and data integrity through deception.
From the perspective of threat intelligence frameworks like MITRE ATT&CK, this vulnerability facilitates techniques associated with Initial Access and Credential Harvesting. Specifically, it aligns with T1566 Phishing, where attackers use deceptive tactics to trick users into revealing sensitive information or installing malware. The ability to spoof UI elements enhances the effectiveness of these phishing attempts by making malicious pages appear more legitimate or urgent than they actually are. For instance, an attacker could mimic a login prompt for a popular service within a frame that appears to be part of the browser's native interface, thereby bypassing user skepticism. This requires careful crafting of HTML and CSS to exploit rendering inconsistencies in older versions of Chrome on Android, highlighting the importance of keeping browsers updated to ensure that such UI manipulation techniques are patched or mitigated by improved security controls.
Mitigation for this vulnerability is straightforward and relies primarily on software maintenance practices. Users must update Google Chrome on their Android devices to version 154.0.8037.57 or later, where the rendering logic has been corrected to prevent unauthorized UI layer manipulation. In addition to updating the browser, organizations should enforce policies that discourage users from interacting with untrusted web content and educate them about recognizing signs of UI spoofing, such as unexpected pop-ups or inconsistencies in layout. Security awareness training is crucial here because technical controls alone cannot fully mitigate social engineering attacks that exploit human psychology. Furthermore, enabling features like Safe Browsing can provide an additional layer of protection by warning users when they attempt to visit known malicious sites, although this does not directly patch the underlying UI flaw but rather helps detect some of the payloads used in conjunction with such exploits.