Description
UI misrepresentation in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: UI Spoofing
Action: Immediate Patch
AI Analysis

Impact

The CVE identifies a UI misrepresentation flaw in the Messages component of Google Chrome for Android before version 156.0.8078.47. A maliciously crafted HTML page can cause Chrome to display spoofed UI elements, such as counterfeit prompts or buttons. This misrepresentation can trick users into interacting with unintended interfaces, creating a vector for phishing or click‑jacking. Chromium rates the issue as low severity, despite the high CVSS score, and the weakness falls under CWE‑451.

Affected Systems

Google Chrome on Android devices running a version older than 156.0.8078.47 are affected. The description does not mention Chrome on desktop or newer Android releases, so only those older Android builds are impacted.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity. The EPSS rating of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack requires a remote attacker to deliver a malicious HTML page that the victim opens in Chrome, inferred from the description. Immediate patching is recommended due to the potential for social engineering and credential theft.

Generated by OpenCVE AI on November 4, 2026 at 05:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Google Chrome on Android to version 156.0.8078.47 or newer if available (install the latest stable channel from the Play Store).
  • If the device cannot be updated, disable or uninstall Chrome, or switch to an alternative, non‑affected browser.
  • Until a patch is available, enable Chrome Safe Browsing, block or filter suspicious or unknown webpages, and train users to avoid clicking unfamiliar links.

Generated by OpenCVE AI on November 4, 2026 at 05:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4853-1 chromium security update
Debian DSA Debian DSA DSA-6577-1 chromium security update
History

Wed, 04 Nov 2026 06:15:00 +0000

Type Values Removed Values Added
Title UI Spoofing Vulnerability in Chrome on Android via Crafted HTML

Wed, 04 Nov 2026 02:45:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Memory Corruption in Chrome Messages on Android

Tue, 03 Nov 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119

Tue, 03 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Description Memory corruption in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) UI misrepresentation in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
Weaknesses CWE-451

Fri, 23 Oct 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Google android
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
Vendors & Products Google android

Thu, 22 Oct 2026 11:45:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Memory Corruption in Chrome Messages on Android

Wed, 21 Oct 2026 08:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 20 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Memory corruption in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Weaknesses CWE-119
References

Subscriptions

Google Android Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-11-03T21:21:13.279Z

Reserved: 2026-10-19T23:03:03.871Z

Link: CVE-2026-113145

cve-icon Vulnrichment

Updated: 2026-10-20T22:51:21.518Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:19:06.880

Modified: 2026-11-03T22:18:39.780

Link: CVE-2026-113145

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T06:00:16Z

Weaknesses
  • CWE-451

    User Interface (UI) Misrepresentation of Critical Information