CVE-2026-0906: Google Chrome Android XSS Vulnerability

CVE-2026-0906 Overview

CVE-2026-0906 is an Incorrect Security UI vulnerability affecting Google Chrome on Android prior to version 144.0.7559.59. This flaw allows a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page, potentially deceiving users into believing they are visiting a legitimate website when they are actually on a malicious domain.

Critical Impact

This URL bar spoofing vulnerability enables sophisticated phishing attacks where attackers can display fake URLs in the browser's address bar, making it extremely difficult for users to distinguish between legitimate and malicious websites.

Affected Products

• Google Chrome on Android prior to version 144.0.7559.59
• Chromium-based browsers on Android using vulnerable engine versions

Discovery Timeline

• 2026-01-20 - CVE-2026-0906 published to NVD
• 2026-01-20 - Last updated in NVD database

Technical Details for CVE-2026-0906

Vulnerability Analysis

This vulnerability falls under CWE-451 (User Interface (UI) Misrepresentation of Critical Information). The flaw exists in Chrome's security UI implementation on Android, specifically affecting how the browser renders and validates the Omnibox contents. When a user navigates to a malicious page containing specially crafted HTML, the attacker can manipulate the displayed URL in the address bar to show a different domain than the one actually being visited.

The attack can be executed remotely with no authentication required, and critically, no user interaction beyond visiting the malicious page is needed for the spoofing to occur. This makes the vulnerability particularly dangerous for phishing campaigns targeting mobile users.

Root Cause

The vulnerability stems from improper validation and rendering of URL information in the Chrome Android Omnibox component. The security UI fails to properly sanitize or verify the displayed URL content when processing certain crafted HTML elements, allowing attackers to inject misleading information into the trusted browser chrome area.

Attack Vector

The attack is network-based and can be initiated when a victim visits an attacker-controlled webpage. The malicious page contains specially crafted HTML that exploits the security UI flaw to display a spoofed URL in the Omnibox. This could be distributed via phishing emails, malicious advertisements, or compromised legitimate websites.

The vulnerability mechanism involves manipulating how Chrome's Android UI renders the Omnibox contents. When the crafted HTML page is loaded, it triggers the incorrect security UI behavior, causing the displayed URL to differ from the actual destination. Technical details regarding the specific exploitation method can be found in the Chromium Issue Tracker Entry.

Detection Methods for CVE-2026-0906

Indicators of Compromise

• Unusual JavaScript behavior on visited pages that manipulates browser UI elements
• Reports from users about URL bar inconsistencies or suspicious redirects
• Network traffic patterns indicating visits to known malicious domains while users report visiting legitimate sites

Detection Strategies

• Monitor for Chrome browser versions below 144.0.7559.59 on Android devices across the organization
• Implement endpoint detection rules to identify attempts to manipulate browser chrome UI components
• Deploy web filtering to block known malicious domains associated with Omnibox spoofing attacks

Monitoring Recommendations

• Enable enhanced browser telemetry to track URL navigation events and detect discrepancies
• Review security logs for patterns indicating phishing attacks leveraging URL spoofing
• Implement user reporting mechanisms for suspicious browser behavior

How to Mitigate CVE-2026-0906

Immediate Actions Required

• Update Google Chrome on all Android devices to version 144.0.7559.59 or later immediately
• Alert users about potential phishing attempts that may exploit this vulnerability
• Review any reported security incidents for possible exploitation of this flaw
• Enforce automatic Chrome updates across managed Android devices

Patch Information

Google has addressed this vulnerability in Chrome version 144.0.7559.59. The fix corrects the security UI implementation to properly validate and render Omnibox contents, preventing URL spoofing via crafted HTML pages. Organizations should refer to the Google Chrome Update Notice for complete patch details.

Workarounds

• Advise users to manually verify URLs by examining the full address and certificate information before entering credentials
• Consider implementing additional security layers such as password managers that validate domains before autofilling
• Deploy mobile device management (MDM) policies to enforce browser version requirements

# Check Chrome version on Android devices via ADB
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output for patched version should show 144.0.7559.59 or higher