CVE Intelligence
Analysis AI-assisted

CVE-2026-0906: Google Chrome for Android Omnibox UI spoofing via crafted HTML

CVE-2026-0906 is an incorrect security UI issue in Google Chrome on Android prior to 144.0.7559.59 that lets a remote attacker spoof the Omnibox (URL bar) using a crafted HTML page. The record assigns a CVSS base score of 9.8, while the Chromium security severity is rated Low, and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-0906 affects Google Chrome on Android before 144.0.7559.59. The record describes an incorrect security user interface flaw that allows a remote attacker to spoof the Omnibox (URL bar) through a crafted HTML page. The record was published on 2026-01-20 by the Chrome CNA.

Impact

  • Spoofing the Omnibox can mislead users about the site they are visiting, which may support phishing or social engineering.
  • The record lists a CVSS base score of 9.8 with network attack vector, no privileges required and no user interaction, while the Chromium security severity is Low.
  • The SSVC data in the record lists exploitation as none and technical impact as total. These are assessments within the record, not evidence of exploitation.

Affected products and versions

  • Google Chrome on Android, prior to 144.0.7559.59.
  • The record also lists 144.0.7559.60 and an affected entry that is internally contradictory, so the exact range should be confirmed with the vendor.

Exploitation status

The CISA KEV catalog does not list this CVE according to the record. No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • Update Google Chrome on Android to a build at or above the fixed version confirmed in the vendor release notes, starting from 144.0.7559.59 as the threshold stated in the description.
  • Review the Chrome Releases blog to confirm the exact fixed build, since the record contains no fixes list.
  • Keep automatic updates enabled on managed Android devices and verify browser versions through device management.

Detection guidance

  • Inventory Android devices running Chrome and record their versions, flagging builds before 144.0.7559.59.
  • Encourage users to report misleading address bar content and review reports of suspicious links that lead to unfamiliar pages.

Limitations of the available information

  • The record has no title, no fixes list and no CWE name, although CWE-451 is assigned.
  • The EPSS date (2026-10-23) is later than the publication date, so the EPSS values should be treated with caution.
  • The affected version entries are contradictory, and the issue tracker entry is restricted, so its details are unknown.

Frequently asked questions

Which Chrome versions are affected by CVE-2026-0906?

The record describes Google Chrome on Android prior to 144.0.7559.59 as affected. The affected entries are partly contradictory, so confirm the exact range in the vendor release notes.

Is CVE-2026-0906 known to be exploited in the wild?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.