CVE-2026-95279: Google Chrome XSS Vulnerability

CVE-2026-95279 Overview

CVE-2026-95279 is a user interface misrepresentation vulnerability in the Omnibox component of Google Chrome on Android. A remote attacker can spoof the address bar by serving a crafted HTML page to the target. The flaw is classified under [CWE-451] (User Interface Misrepresentation of Critical Information) and affects versions of Chrome on Android prior to 154.0.8037.57. Google rates the Chromium security severity as Low, though NVD scores it as Medium due to network-based exploitation with limited user interaction. Successful exploitation supports phishing scenarios by allowing malicious pages to appear as trusted origins.

Critical Impact
Attackers can manipulate the Omnibox to display a spoofed URL, enabling convincing phishing pages that appear to originate from legitimate domains.

Affected Products

Google Chrome for Android versions prior to 154.0.8037.57
Google Android devices running vulnerable Chrome builds
Chromium-based mobile browsers sharing the affected Omnibox code path

Discovery Timeline

2026-09-29 - CVE-2026-95279 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-95279

Vulnerability Analysis

The Omnibox is Chrome's combined address and search bar. It renders the URL of the currently loaded document and serves as the primary trust indicator for users evaluating a site's authenticity. CVE-2026-95279 breaks that trust boundary on Android by allowing a crafted HTML page to influence what the Omnibox displays. The end result is a mismatch between the origin actually loaded in the renderer and the origin shown to the user.

Because the flaw resides in UI rendering logic, exploitation does not require memory corruption or elevated privileges. The attacker only needs the victim to visit a malicious page, which aligns with typical phishing delivery via SMS, messaging apps, email, or malicious ad networks. The impact is confidentiality-focused: users disclose credentials, session tokens, or financial data to attacker-controlled pages while believing they are on a trusted site.

Root Cause

The root cause is improper handling of navigation or document state when the Omnibox computes the string to display. Chromium tracks this in Issue #514012689. Conditions such as slow navigations, redirects, or crafted DOM interactions can cause the browser to present an origin that no longer reflects the active document, satisfying the [CWE-451] pattern.

Attack Vector

Exploitation proceeds over the network and requires the victim to open a crafted HTML page in Chrome for Android. The attacker hosts a page that triggers the spoofing condition, then presents cloned login forms or transaction prompts. Because the Omnibox displays a legitimate-looking URL, standard user checks against phishing fail. No sandbox escape or code execution is involved.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. Refer to the Chromium Issue Tracker entry for technical details as they become available.

Detection Methods for CVE-2026-95279

Indicators of Compromise

Chrome for Android clients reporting a User-Agent version string below 154.0.8037.57 in web server or proxy logs
Outbound requests from mobile endpoints to newly registered domains hosting cloned login pages for banking, enterprise SSO, or webmail services
Credential submissions from mobile browsers to hosts that do not match the expected corporate identity provider

Detection Strategies

Inventory installed Chrome versions across managed Android fleets using Mobile Device Management (MDM) or Unified Endpoint Management (UEM) telemetry and flag builds older than 154.0.8037.57.
Correlate web proxy and DNS logs for mobile user agents visiting low-reputation domains followed by POST requests containing authentication parameters.
Hunt in SIEM data for phishing campaigns that specifically target Chrome on Android using URL patterns designed to trigger address bar spoofing conditions.

Monitoring Recommendations

Ingest mobile browser telemetry and identity provider sign-in logs into a centralized data lake for anomaly analysis of impossible-travel and credential-reuse patterns.
Alert on authentication events originating from mobile devices whose Chrome version has not been updated within the vendor's patch window.
Monitor threat intelligence feeds for phishing kits weaponizing CVE-2026-95279 against enterprise SaaS applications.

How to Mitigate CVE-2026-95279

Immediate Actions Required

Update Google Chrome on all Android devices to version 154.0.8037.57 or later through Google Play or MDM-driven app updates.
Push a policy through MDM/UEM to enforce automatic Chrome updates and block launch of outdated builds where supported.
Reinforce user awareness that address bar contents alone are not a sufficient trust signal, and reiterate use of password managers that bind credentials to origins.

Patch Information

Google addressed CVE-2026-95279 in the Chrome Stable channel update documented in the Google Chrome Stable Update advisory. The fix is included in Chrome for Android 154.0.8037.57. Chromium downstream projects should incorporate the associated commit referenced in Chromium Issue #514012689.

Workarounds

Restrict access to sensitive corporate applications from mobile browsers until the Chrome update is confirmed installed on the device.
Enforce phishing-resistant authentication such as FIDO2/WebAuthn security keys or platform authenticators, which bind credentials to the true origin and defeat address bar spoofing.
Route mobile web traffic through a secure web gateway that blocks known phishing infrastructure and enforces category-based URL filtering.

bash

# Example MDM configuration snippet enforcing minimum Chrome version on Android
# (Android Enterprise managed configuration for com.android.chrome)
{
  "MinimumVersion": "154.0.8037.57",
  "URLBlocklist": ["*"],
  "URLAllowlist": ["https://*.corp.example.com", "https://accounts.google.com"],
  "PasswordManagerEnabled": true,
  "SafeBrowsingProtectionLevel": 2
}