CVE-2026-106209

Analyzed Analyzed - Analysis Complete

Address Bar Spoofing in Google Chrome on iOS

Publication date: 2026-10-06

Last updated on: 2026-10-08

Assigner: Chrome

Description

UI misrepresentation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-08

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106209

EUVD

EUVD-2026-93734

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 155.0.8059.39 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-451	The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.

Attack-Flow Graph

Executive Summary

This vulnerability involves a UI misrepresentation in Google Chrome on iOS. It allows a remote attacker to trick users into believing they are on a legitimate website by spoofing the address bar through a crafted HTML page. This is achieved via social engineering tactics.

Detection Guidance

This vulnerability involves UI misrepresentation in Google Chrome on iOS, which cannot be directly detected via network or system commands. Users should check the Chrome version installed on iOS devices and ensure it is updated to 155.0.8059.39 or later.

Impact Analysis

This vulnerability could lead to users unknowingly entering sensitive information like passwords or credit card details on fake websites that appear legitimate due to the spoofed address bar. It may also result in phishing attacks or unauthorized access to user accounts.

Compliance Impact

This vulnerability involves UI misrepresentation, which could potentially lead to phishing attacks by tricking users into visiting malicious sites. While it does not directly impact data security, it may contribute to unauthorized access or data breaches if exploited, indirectly affecting compliance with standards like GDPR or HIPAA that require secure user interactions and protection against deception.

Mitigation Strategies

Update Google Chrome on all iOS devices to version 155.0.8059.39 or later. Avoid visiting untrusted websites or clicking suspicious links until the update is applied.

Hi! I’m here to help you understand CVE-2026-106209. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70