CVE-2026-84330: Google Chrome Android XSS Vulnerability

CVE-2026-84330 Overview

CVE-2026-84330 is a user interface misrepresentation vulnerability in the FullScreen component of Google Chrome on Android. Versions prior to 152.0.7977.75 allow a remote attacker to spoof the browser address bar through a crafted HTML page. The flaw is classified under CWE-451: User Interface (UI) Misrepresentation of Critical Information. Chromium's security team rates this issue at Medium severity. Successful exploitation requires user interaction, such as visiting a malicious web page and entering full-screen mode. The vulnerability facilitates phishing and social engineering attacks by allowing attackers to display a misleading origin to the victim.

Critical Impact
Attackers can spoof the address bar in Chrome for Android to impersonate trusted websites, enabling credential theft and phishing campaigns against mobile users.

Affected Products

Google Chrome for Android prior to 152.0.7977.75
Chromium-based browsers on Android that share the FullScreen implementation
Mobile applications embedding vulnerable Chrome WebView builds

Discovery Timeline

2026-09-02 - CVE-2026-84330 published to the National Vulnerability Database
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84330

Vulnerability Analysis

The vulnerability resides in how Chrome for Android renders the browser UI during full-screen transitions. When a page enters full-screen mode, the browser hides its native address bar to maximize screen real estate for content. An attacker crafts an HTML page that abuses this transition to render attacker-controlled content in a position or style that mimics the legitimate address bar. A victim viewing the crafted page perceives a URL or security indicator that does not reflect the true origin of the content. This class of flaw, tracked as CWE-451, undermines the trust anchor that users rely on to verify the identity of a website.

Root Cause

The root cause is an inconsistency between the FullScreen API state and the security-critical UI chrome rendered by the Android browser process. The FullScreen handler fails to enforce a visual separation between page content and browser-owned indicators. Attacker-controlled HTML and CSS can therefore occupy screen regions that users associate with browser-authoritative information.

Attack Vector

Exploitation requires a victim to visit an attacker-controlled or compromised web page using a vulnerable version of Chrome for Android. The page invokes the FullScreen API and renders spoofed browser chrome, including a fake address bar showing a trusted domain such as a banking or corporate login portal. Because the attack is network-based and does not require authentication, any user browsing untrusted content is at risk. Details are tracked publicly in the Chromium Issue Tracker #517091927 and the Google Chrome Stable Update announcement.

Detection Methods for CVE-2026-84330

Indicators of Compromise

Mobile endpoints running Chrome for Android versions earlier than 152.0.7977.75
Web traffic to pages that invoke Element.requestFullscreen() immediately followed by rendering of URL-shaped strings within the DOM
User reports of address bars that fail to retract or update correctly during full-screen transitions
Phishing landing pages served over HTTPS but requesting credentials for unrelated domains

Detection Strategies

Inspect proxy and DNS logs for connections to newly registered domains hosting HTML that combines full-screen requests with rendered URL bars
Correlate mobile browser version telemetry with visited URLs to identify at-risk sessions
Deploy content inspection rules that flag pages using the FullScreen API in conjunction with credential input forms

Monitoring Recommendations

Track Chrome for Android version distribution across managed mobile devices through MDM reporting
Alert on user-submitted phishing reports referencing full-screen prompts or unexpected address bar behavior
Monitor authentication logs for credential submissions originating from mobile Chrome sessions following visits to low-reputation domains

How to Mitigate CVE-2026-84330

Immediate Actions Required

Update Google Chrome for Android to version 152.0.7977.75 or later through the Google Play Store
Enforce automatic browser updates on managed Android devices via mobile device management policies
Communicate the risk of address bar spoofing to mobile users and reinforce phishing awareness training

Patch Information

Google addressed CVE-2026-84330 in Chrome 152.0.7977.75 on Android. Details of the release are available in the Google Chrome Stable Channel Update, September 2026. Enterprises managing Android fleets should confirm the patched version is deployed across all devices and validate distribution through the Play Managed Store.

Workarounds

Instruct users to exit full-screen mode by swiping down from the top of the screen before entering credentials
Restrict access to untrusted web content on corporate Android devices using web filtering policies
Disable JavaScript for high-risk browsing contexts where full-screen APIs are not required

bash

# Verify installed Chrome version on a managed Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output for patched devices:
# versionName=152.0.7977.75