CVE-2026-17938 Overview
CVE-2026-17938 is a user interface (UI) spoofing vulnerability in the FullScreen implementation of Google Chrome on Android. Versions of Chrome for Android prior to 151.0.7922.72 allow a remote attacker to display misleading browser UI through a crafted HTML page. The Chromium project rated this issue as Low severity.
The flaw affects the FullScreen API behavior on mobile, where attacker-controlled content can imitate legitimate browser chrome or system dialogs. This class of issue supports phishing and credential-harvesting campaigns by tricking users into trusting rendered content.
Critical Impact
A remote attacker can serve a crafted HTML page that manipulates FullScreen UI on Android Chrome to spoof legitimate browser elements and deceive users.
Affected Products
- Google Chrome on Android prior to 151.0.7922.72
Discovery Timeline
- 2026-07-30 - CVE-2026-17938 published to the National Vulnerability Database (NVD)
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-17938
Vulnerability Analysis
CVE-2026-17938 is classified as a User Interface Confusion issue in the FullScreen implementation of Chrome on Android. The vulnerability enables a remote attacker to render page content that visually overlaps or imitates trusted browser UI elements when a page enters fullscreen mode. Because mobile browser chrome is minimal, attacker-supplied HTML can convincingly reproduce address bars, permission prompts, or system indicators.
Successful exploitation does not yield code execution or memory corruption. Instead, it undermines the visual trust boundary between web content and browser UI. This trust boundary is the primary defense users rely on when judging whether a page is legitimate.
Root Cause
The root cause is an inappropriate implementation in how Chrome for Android manages the FullScreen state and the rendering of security-relevant UI elements over web content. The browser does not sufficiently constrain what an attacker-controlled page can draw or how the transition into and out of fullscreen is presented. Refer to the Chromium Issue Tracker entry for additional technical detail.
Attack Vector
An attacker hosts a crafted HTML page and lures an Android Chrome user to visit it, typically through phishing, malvertising, or a compromised site. When the page invokes the FullScreen API, it renders content that spoofs browser UI, such as a fake URL bar or fake permission dialog. The user then acts on the spoofed interface believing it is legitimate, potentially disclosing credentials or approving sensitive actions.
No verified public proof-of-concept is available. The vulnerability mechanism is described in the vendor advisory referenced in the Google Chrome Stable Update announcement.
Detection Methods for CVE-2026-17938
Indicators of Compromise
- User reports of unexpected fullscreen transitions on Android Chrome followed by prompts requesting credentials or sensitive permissions.
- Web traffic to newly registered or low-reputation domains that serve pages invoking the FullScreen API immediately on load.
- Phishing lures directing Android users specifically to mobile-optimized landing pages.
Detection Strategies
- Inspect web proxy and DNS logs for outbound connections from Android devices to domains associated with phishing infrastructure.
- Correlate mobile browsing telemetry with known phishing indicators and threat intelligence feeds.
- Review help-desk tickets and user reports for descriptions matching UI spoofing behavior on mobile Chrome.
Monitoring Recommendations
- Monitor Chrome for Android version reporting from mobile device management (MDM) to identify endpoints running versions prior to 151.0.7922.72.
- Track credential submission events to unexpected external domains from managed mobile devices.
- Alert on repeated navigation to URLs that immediately trigger fullscreen behavior on mobile user agents.
How to Mitigate CVE-2026-17938
Immediate Actions Required
- Update Google Chrome on Android to version 151.0.7922.72 or later through the Google Play Store.
- Push the updated Chrome version through MDM to enrolled Android devices.
- Communicate to users that legitimate browser UI never appears inside page content and that they should exit fullscreen before entering credentials.
Patch Information
Google addressed CVE-2026-17938 in Chrome for Android 151.0.7922.72. Refer to the Google Chrome Stable Update announcement for release details and to the Chromium Issue Tracker entry for the underlying issue.
Workarounds
- Instruct users to exit fullscreen mode (swipe or tap the exit control) before entering credentials or approving prompts.
- Restrict browsing on managed Android devices to allow-listed domains where feasible.
- Deploy phishing-resistant authentication such as FIDO2 security keys to reduce impact if a user is deceived by a spoofed UI.
# Verify the installed Chrome version on an Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
