CVE-2026-10984: Google Chrome Android UI Spoofing Vulnerability – Medium Severity

Technical summary

CVE-2026-10984 stems from an inappropriate implementation in the accessibility layer of Google Chrome on Android versions prior to 149.0.7827.53. The vulnerability enables UI spoofing attacks through specially crafted HTML pages. The accessibility subsystem's handling of UI elements fails to properly enforce visual boundaries or authenticity checks, permitting remote attackers to overlay or manipulate on-screen interface components visible to end users. This falls under CWE-451 (User Interface (UI) Misrepresentation of Critical Information), a class of flaws where security-relevant information is rendered in a manner that misleads the user about its origin or trustworthiness.

Business impact

For enterprises managing Android devices—particularly BYOD environments or organizations with significant mobile workforces—this vulnerability presents a social engineering vector. Attackers could craft convincing phishing pages that harvest credentials or trick users into authorizing sensitive actions. The impact spans confidentiality (credential theft) and availability (users disrupted by fraudulent prompts), though the vulnerability does not directly enable code execution or data extraction from Chrome itself. Organizations relying on Chrome as a primary mobile browser face elevated risk of credential compromise and user misdirection attacks.

Affected systems

Google Chrome on Android versions prior to 149.0.7827.53 are affected. Desktop and iOS versions of Chrome are not impacted by this specific accessibility flaw. The vulnerability is limited to the Android platform due to differences in how accessibility features are implemented across operating systems. Any Android device running an affected Chrome version—including older devices that may not receive automatic updates—remains at risk until patched.

Exploitability

The vulnerability carries a CVSS 3.1 score of 5.4 (MEDIUM severity) and is network-accessible with low attack complexity. It requires user interaction: a victim must visit a malicious webpage for the attack to succeed. The attack vector does not require authentication or elevated privileges. While the barrier to exploitation is low from a technical standpoint, the practical success rate depends on social engineering effectiveness. The vulnerability is not currently tracked on the CISA KEV catalog, indicating no evidence of active exploitation in the wild at the time of publication.

Remediation

Organizations should prioritize updating Chrome on Android to version 149.0.7827.53 or later across all managed and unmanaged devices. For enterprises: deploy Chrome updates through mobile device management (MDM) tools where available, and communicate the patch urgently to users with personal devices accessing corporate resources. For end users: enable automatic Chrome updates in Google Play Store settings, or manually check Chrome > About Chrome for available updates. Verify successful patch deployment through MDM dashboards or device inventory systems.

Patch guidance

Google released the patch in Chrome version 149.0.7827.53 for Android. Deployment path: Open the Google Play Store app → Search 'Chrome' → If an update is available, tap 'Update' or enable auto-update. IT administrators managing Chrome via Google Play Enterprise or similar deployment systems should push the update to all enrolled devices immediately. Verify patch status by navigating to Chrome Settings > About Chrome, which will display the installed version. No interim mitigations exist; patching is the only remediation. Confirm the targeted version against the official Chromium security release notes to ensure alignment with your deployment infrastructure.

Detection guidance

Detection at the endpoint level is challenging, as the vulnerability manifests through user interaction with rendered content rather than network-level indicators. Security teams should: (1) Monitor Chrome version inventory in MDM solutions to identify unpatched devices; (2) alert users via security awareness communications about UI spoofing risks and how to verify page authenticity before entering credentials; (3) implement email filtering rules to block known phishing campaigns that might exploit this flaw; (4) review user access logs and authentication events for suspicious patterns (impossible travel, unusual login times) that may indicate credential compromise via UI spoofing. Endpoint Detection and Response (EDR) tools cannot detect the vulnerability directly, but may flag unusual Chrome process behavior or credential exfiltration post-exploitation.

Why prioritize this

Although CVSS 5.4 places this in the MEDIUM severity band, the accessibility-layer nature and UI spoofing capability warrant elevated priority for mobile-heavy organizations. The vulnerability is easy to exploit from an attacker's perspective (network-accessible, low complexity) and aligns with common phishing and social engineering tactics. The lack of KEV designation suggests limited current exploitation, but the attack pattern—user-facing fraud—is well-understood and likely to be weaponized once awareness spreads. Organizations with significant Android deployments or high-value mobile users should treat this as a near-term patching objective rather than a routine update cycle task.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects network accessibility and low attack complexity offset by the requirement for user interaction and the limited impact scope (UI manipulation, not code execution). The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L indicates integrity and availability impacts are low in the scoring model because the attack does not breach Chrome's sandbox or corrupt persistent data. However, the *practical* risk to organizations is higher: the vulnerability enables credential theft and unauthorized user actions, which carry significant downstream consequences. Security leaders should weight the accessibility layer's trust implications more heavily than the CVSS score alone suggests.

Frequently asked questions