CVE-2026-95337 Overview
CVE-2026-95337 is a user interface (UI) misrepresentation vulnerability affecting the Messages component in Google Chrome on Android. A remote attacker who convinces a victim to visit a crafted HTML page can spoof UI elements rendered by the browser. The flaw is tracked under CWE-451: User Interface (UI) Misrepresentation of Critical Information and requires user interaction to trigger. Google Chrome versions prior to 154.0.8037.57 on Android are affected. Chromium classifies the issue with Medium security severity.
Critical Impact
Attackers can spoof browser UI elements through crafted web content, enabling social engineering attacks that trick Android users into trusting malicious pages or messages.
Affected Products
- Google Chrome for Android versions prior to 154.0.8037.57
- Google Android platform hosting vulnerable Chrome builds
- Chromium-based components that reuse the affected Messages UI code
Discovery Timeline
- 2026-09-29 - CVE-2026-95337 published to the National Vulnerability Database (NVD)
- 2026-09-30 - Last updated in NVD database
- Vendor advisory published in the Chrome Releases Stable Channel Update
Technical Details for CVE-2026-95337
Vulnerability Analysis
The vulnerability resides in the Messages surface of Chrome for Android. Chrome uses Messages to render prompts, banners, and permission requests above web content. A crafted HTML page can manipulate how these UI elements are drawn or positioned. The result is that adversary-controlled web content can appear to be a trusted browser prompt.
Because the attacker abuses the trust boundary between page content and browser chrome, exploitation depends on social engineering. A user must load the malicious page and act on the spoofed element. The impact is limited to confidentiality and availability at a low level, with no integrity impact recorded in the vendor scoring.
Root Cause
The root cause is improper separation between renderer-controlled content and browser-controlled Messages UI on the Android form factor. The condition maps to [CWE-451], where security-relevant information is displayed to the user in a misleading way. Full technical details are tracked in the Chromium Issue Tracker entry.
Attack Vector
Exploitation is remote and network-based. An attacker hosts a crafted HTML page and lures a victim using Chrome for Android to visit it. The page then renders content that mimics legitimate Messages UI elements such as permission prompts, download bars, or account dialogs. A user tapping the spoofed element may disclose data, grant a permission, or trust attacker-supplied content.
No verified public exploit code or proof-of-concept is available for CVE-2026-95337 at the time of publication. Refer to the Chromium Issue Tracker entry for technical details.
Detection Methods for CVE-2026-95337
Indicators of Compromise
- Chrome for Android clients reporting a version string below 154.0.8037.57 in HTTP User-Agent headers or endpoint inventory
- Web proxy or DNS telemetry showing users navigating to newly registered domains that closely mimic legitimate brand or login pages
- User reports of unexpected browser prompts, permission dialogs, or download banners that behave unusually
Detection Strategies
- Inventory installed Chrome versions across managed Android fleets and flag builds below 154.0.8037.57
- Correlate mobile browsing telemetry with threat intelligence feeds covering phishing infrastructure and typosquatted domains
- Hunt for outbound requests to short-lived HTML hosting services that deliver pages containing overlay or fixed-position elements mimicking Chrome chrome
Monitoring Recommendations
- Enable mobile threat defense telemetry to surface risky URL categories accessed from Chrome for Android
- Monitor mobile device management (MDM) reports for Chrome update compliance and enforce automatic updates
- Track user-submitted phishing reports for patterns consistent with browser UI spoofing on Android
How to Mitigate CVE-2026-95337
Immediate Actions Required
- Update Chrome for Android to version 154.0.8037.57 or later through Google Play
- Enforce a minimum Chrome version policy via MDM for all managed Android devices
- Communicate to users that legitimate browser prompts never request credentials inside embedded web content
Patch Information
Google addressed CVE-2026-95337 in Chrome 154.0.8037.57 for Android. Details are documented in the Chrome Releases Stable Channel Update. Administrators should verify deployment through Google Play managed configurations and confirm the updated version on endpoints.
Workarounds
- Restrict browsing to trusted sites through mobile web filtering until patched Chrome builds are deployed
- Disable installation of untrusted browser profiles and extensions on managed Android devices
- Deliver targeted user awareness training focused on identifying spoofed browser prompts and validating URLs before granting permissions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
