CVE-2024-6995 Overview
CVE-2024-6995 is a URL bar spoofing vulnerability affecting Google Chrome on Android prior to version 127.0.6533.72. The flaw resides in the Fullscreen implementation and allows a remote attacker to spoof the contents of the Omnibox after convincing a user to perform specific UI gestures. Exploitation requires a crafted HTML page and user interaction. Google classifies the Chromium security severity as Medium. The weakness is tracked under [CWE-358: Improperly Implemented Security Check for Standard].
Critical Impact
Attackers can display a misleading URL in the address bar while serving attacker-controlled content, enabling convincing phishing and credential-harvesting campaigns against Android Chrome users.
Affected Products
- Google Chrome for Android prior to 127.0.6533.72
- Google Android platform (Chrome browser component)
- Chromium-based mobile browsers inheriting the Fullscreen implementation
Discovery Timeline
- 2024-08-06 - CVE-2024-6995 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-6995
Vulnerability Analysis
The vulnerability is a user-interface spoofing issue in Chrome for Android's Fullscreen mode. When a page enters fullscreen and the user performs certain gestures, the browser incorrectly renders the Omnibox contents. This allows an attacker-controlled page to present a URL that does not match the actual origin serving the content.
URL bar integrity is a foundational trust boundary in modern browsers. Users rely on the Omnibox to verify the origin of the page and any TLS indicators. Breaking this contract enables phishing attacks that would otherwise be blocked by user vigilance or password manager domain checks.
The issue is categorized under [CWE-358] because the security check governing Omnibox rendering during Fullscreen transitions is improperly implemented. No memory corruption or code execution results from the flaw. Impact is limited to spoofing user-facing security indicators.
Root Cause
The root cause lies in the Fullscreen component's handling of Omnibox state during specific UI gesture sequences on Android. The implementation fails to correctly synchronize the address bar contents with the active document, producing a state where displayed and actual origins diverge. Refer to Chromium Issue #343938078 for the upstream tracker.
Attack Vector
Exploitation is network-based and requires user interaction. An attacker hosts a crafted HTML page that triggers fullscreen mode and prompts the victim to perform specific gestures. Once the spoof condition is achieved, the Omnibox displays an arbitrary URL of the attacker's choosing while the page continues serving attacker-controlled content. The attacker can then present convincing login prompts, fake bank interfaces, or fraudulent download pages under the guise of a trusted domain.
No verified proof-of-concept code is publicly available for this vulnerability. Technical details are described in the Chromium Issue #343938078 tracker.
Detection Methods for CVE-2024-6995
Indicators of Compromise
- Chrome for Android client versions below 127.0.6533.72 connecting to untrusted web resources
- Web traffic to pages that programmatically request Fullscreen API access followed by unusual gesture prompts
- User reports of address bar contents that do not match visited domains during fullscreen browsing
Detection Strategies
- Inventory Android endpoints and query Chrome build strings via mobile device management to identify vulnerable installs
- Inspect HTTP responses for pages invoking Element.requestFullscreen() combined with overlay elements that mimic browser chrome
- Correlate phishing report telemetry with Chrome version data to prioritize vulnerable users
Monitoring Recommendations
- Monitor web proxy and DNS logs for newly registered domains hosting credential-harvesting content targeting mobile users
- Track browser version distribution across the managed Android fleet and alert on out-of-date installs
- Ingest mobile threat defense telemetry into the security data lake to correlate suspicious page loads with user credential submissions
How to Mitigate CVE-2024-6995
Immediate Actions Required
- Update Google Chrome for Android to version 127.0.6533.72 or later through the Google Play Store
- Push mandatory browser updates via mobile device management for enrolled Android devices
- Notify end users of the phishing risk and reinforce guidance to close fullscreen pages that request unexpected gestures
Patch Information
Google addressed CVE-2024-6995 in Chrome for Android 127.0.6533.72. See the Google Chrome Stable Update advisory for release notes covering the fix. Enterprises managing Android fleets should enforce automatic updates through Google Play or MDM policies to ensure timely remediation.
Workarounds
- Disable or restrict the Fullscreen API on high-risk enterprise web properties until users upgrade
- Use mobile threat defense policies to block navigation to newly registered or low-reputation domains on managed devices
- Deploy phishing-resistant authentication such as FIDO2 to reduce the impact of successful URL spoofing
# Verify installed Chrome version on an Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output for a patched install:
# versionName=127.0.6533.72 (or higher)
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
