Description
Inappropriate implementation in Messages in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-07-30
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An inappropriate implementation in the Messages component of Google Chrome for Android allows a remote attacker to persuade users that a maliciously crafted HTML page is part of the legitimate browser UI. The flaw, classified as CWE-1021 and CWE-451, permits UI spoofing that can deceive users into divulging credentials or engaging with content that compromises confidentiality or integrity. The impact is limited to deception and social engineering rather than direct code execution.

Affected Systems

This vulnerability affects Google Chrome for Android versions before 151.0.7922.72. Users who have not upgraded to the latest stable release, 151.0.7922.72 or newer, are at risk.

Risk and Exploitability

The CVSS score of 6.5 reflects a medium severity, and the EPSS score of less than 1% indicates a very low probability of exploitation in the current environment. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote, crafted HTML page that the user must load in the browser, making widespread exploitation difficult but still possible if users visit malicious sites.

Generated by OpenCVE AI on August 3, 2026 at 12:09 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Chrome for Android to version 151.0.7922.72 or later.
  • If an upgrade is delayed, block or disable the Messages component via enterprise policy or developer options.
  • Deploy anti‑phishing tools and conduct user training to verify site authenticity before entering sensitive data.

Generated by OpenCVE AI on August 3, 2026 at 12:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4710-1 chromium security update
Debian DSA Debian DSA DSA-6408-1 chromium security update
History

Fri, 31 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-451
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N'}

Fri, 31 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: chromium-browser: Inappropriate implementation in Messages
Weaknesses CWE-1021
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

threat_severity

Moderate

Thu, 30 Jul 2026 05:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Thu, 30 Jul 2026 01:00:00 +0000

Type Values Removed Values Added
Description Inappropriate implementation in Messages in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
References

Subscriptions

Google Android Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-31T16:12:54.158Z

Reserved: 2026-07-27T23:34:47.126Z

Link: CVE-2026-17793

cve-icon Vulnrichment

Updated: 2026-07-31T16:11:54.778Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-30T01:16:42.683

Modified: 2026-08-03T13:44:26.477

Link: CVE-2026-17793

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-30T00:19:22Z

Links: CVE-2026-17793 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T12:15:03Z

Weaknesses
  • CWE-1021

    Improper Restriction of Rendered UI Layers or Frames

  • CWE-451

    User Interface (UI) Misrepresentation of Critical Information