CVE-2026-7993: Google Chrome RCE Vulnerability

CVE-2026-7993 Overview

CVE-2026-7993 is an input validation vulnerability in the Payments component of Google Chrome on Android. The flaw exists in versions prior to 148.0.7778.96 and allows a remote attacker who has already compromised the renderer process to spoof the contents of the Omnibox (URL bar) using a crafted HTML page. Google classifies this issue as Medium severity under the Chromium security policy. The weakness is tracked under CWE-20: Improper Input Validation.

Critical Impact
Attackers who control a compromised renderer can display a misleading URL in the address bar, enabling convincing phishing and credential theft scenarios on Android Chrome users.

Affected Products

Google Chrome on Android prior to 148.0.7778.96
Google Android devices running vulnerable Chrome builds
Chromium-based mobile browser components inheriting the Payments code path

Discovery Timeline

2026-05-06 - CVE-2026-7993 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-7993

Vulnerability Analysis

The vulnerability resides in the Payments subsystem of Google Chrome on Android. Chrome's Payments code accepts data from the renderer process and uses it during user-facing flows that interact with the Omnibox. Insufficient validation of this untrusted input allows an attacker-controlled renderer to influence what is displayed in the URL bar.

Omnibox spoofing breaks a core trust boundary of the browser. Users rely on the address bar to confirm the origin of the page they are viewing. When an attacker can desynchronize the displayed URL from the actual document origin, the user has no reliable visual cue to distinguish a legitimate site from a malicious one.

Exploitation requires a prior renderer compromise, which raises attack complexity. However, renderer exploits are routinely chained with sandbox-confined UI flaws to escalate the impact of a single bug into a full phishing primitive.

Root Cause

The root cause is improper validation of untrusted input passed from the renderer into the Payments flow. Data that should have been treated as attacker-controlled was used in a context that influences trusted browser UI, specifically the Omnibox. This corresponds to [CWE-20].

Attack Vector

The attack is network-based and requires user interaction. An attacker first needs to compromise the Chrome renderer process, typically through a separate memory corruption or logic bug. The attacker then serves a crafted HTML page that triggers the Payments code path and manipulates the URL bar contents on Android. No additional privileges are required beyond renderer control.

No verified public proof-of-concept code is available. See the Chromium Issue Tracker entry for technical context once the report is unrestricted.

Detection Methods for CVE-2026-7993

Indicators of Compromise

Android devices running Google Chrome versions earlier than 148.0.7778.96
Browser telemetry showing unexpected renderer crashes followed by Payments API invocations
Phishing reports from users describing legitimate-looking URLs on pages that capture credentials or payment data

Detection Strategies

Inventory Chrome versions across managed Android fleets and flag any build below 148.0.7778.96
Correlate web proxy logs with user-reported phishing to identify pages that trigger Payments flows from low-reputation origins
Monitor mobile EDR telemetry for Chrome renderer exploitation patterns that often precede UI spoofing chains

Monitoring Recommendations

Enable Chrome Enterprise reporting to centralize browser version and crash data
Track outbound connections from Chrome on Android to newly registered or low-reputation domains hosting payment forms
Alert on user-submitted phishing reports referencing trusted brands accessed through mobile Chrome

How to Mitigate CVE-2026-7993

Immediate Actions Required

Update Google Chrome on Android to version 148.0.7778.96 or later through the Google Play Store
Push the updated Chrome build to managed Android devices using MDM enforcement policies
Communicate phishing awareness guidance to users, emphasizing that the address bar alone may be insufficient on unpatched devices

Patch Information

Google released the fix in Chrome 148.0.7778.96 for Android. Refer to the Google Chrome Update Announcement for the official release notes and the Chromium Issue Tracker Entry for the underlying bug reference.

Workarounds

Restrict use of Chrome on Android to patched builds via mobile device management baseline policies
Direct users to verify site identity through bookmarks or typed URLs rather than relying solely on the displayed Omnibox value
Block known phishing infrastructure at the DNS or secure web gateway layer until patch deployment is complete

bash

# Verify Chrome version on a managed Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output should be 148.0.7778.96 or higher