CVE-2026-18007: Google Chrome Android XSS Vulnerability

CVE-2026-18007 Overview

CVE-2026-18007 is a user interface (UI) spoofing vulnerability in Google Chrome on Android. The flaw stems from an inappropriate implementation in the Input component. A remote attacker can serve a crafted HTML page that manipulates browser UI elements to mislead users. Google has assigned this issue a Chromium security severity rating of Low. The vulnerability affects Chrome for Android versions prior to 151.0.7922.72. Successful exploitation enables phishing, credential theft, or other social engineering attacks by making malicious content appear legitimate within the browser interface.

Critical Impact
Attackers can spoof browser UI elements on Android devices to deceive users into trusting malicious content, enabling phishing and social engineering campaigns.

Affected Products

Google Chrome on Android prior to 151.0.7922.72
Chromium-based mobile browsers on Android inheriting the vulnerable Input implementation
Android WebView components using pre-151 Chromium builds

Discovery Timeline

2026-07-30 - CVE-2026-18007 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-18007

Vulnerability Analysis

The vulnerability resides in the Input component of Google Chrome on Android. Chromium classifies the issue as an inappropriate implementation, meaning the code operates outside its intended security boundary. Attackers exploit this weakness through a crafted HTML page loaded in a victim's browser. The result is UI spoofing, where displayed browser chrome or overlay elements misrepresent the true origin or state of page content. This class of flaw maps to User Interface Confusion and aligns with CWE-451 (User Interface Misrepresentation of Critical Information). Mobile browsers are especially vulnerable to spoofing because limited screen real estate reduces the visible security indicators available to users.

Root Cause

The root cause is an inappropriate implementation within the Input subsystem of Chrome for Android. The affected code path allows attacker-controlled HTML to influence how the browser renders or handles input surfaces. This behavior breaks the isolation between web content and trusted browser UI. Details on the specific rendering path are tracked in Chromium Issue Tracker #522404101.

Attack Vector

Exploitation requires the victim to visit a crafted web page controlled by the attacker. No authentication or privileges are needed on the target device. The attacker delivers HTML content that manipulates input handling to overlay or misrepresent browser UI elements. Common outcomes include fake address bars, spoofed permission prompts, or misleading dialog overlays. Because the vector is a standard web page, attackers can distribute the payload via phishing links, malvertising, or compromised websites.

No verified public proof-of-concept code is available. Refer to the Chromium Issue Tracker entry and the Google Chrome release announcement for additional technical context as it becomes available.

Detection Methods for CVE-2026-18007

Indicators of Compromise

Android devices running Chrome versions earlier than 151.0.7922.72 visiting untrusted external URLs
User reports of unexpected browser dialogs, duplicated address bars, or permission prompts on mobile pages
Outbound connections to newly registered domains hosting HTML content targeting mobile user agents

Detection Strategies

Inventory Chrome for Android versions across managed mobile fleets and flag installations below 151.0.7922.72
Correlate mobile browser telemetry with threat intelligence feeds tracking phishing infrastructure that abuses UI spoofing techniques
Monitor URL reputation and category data for user visits to domains delivering suspicious HTML redirect chains

Monitoring Recommendations

Enable mobile device management (MDM) reporting to track Chrome version compliance in real time
Log DNS and HTTP requests from mobile devices to identify visits to attacker-controlled pages
Review user-reported phishing incidents for patterns suggesting UI overlay abuse on Android

How to Mitigate CVE-2026-18007

Immediate Actions Required

Update Google Chrome on Android to version 151.0.7922.72 or later through the Google Play Store
Enforce automatic app updates on managed Android devices via MDM policy
Communicate phishing awareness guidance to users, emphasizing verification of URLs and permission prompts

Patch Information

Google addressed this vulnerability in Chrome for Android version 151.0.7922.72. Users should install the update through the Google Play Store. Enterprise administrators should push the update through mobile device management platforms. Reference the Google Chrome release announcement for the official advisory.

Workarounds

Restrict browsing to trusted sites through mobile web content filtering until the patch is applied
Deploy secure web gateway or DNS filtering on mobile devices to block known phishing domains
Advise users to close and relaunch Chrome if browser UI behaves unexpectedly on a web page

bash

# Verify Chrome for Android version via ADB on a managed device
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output for patched builds:
# versionName=151.0.7922.72 (or later)