CVE-2026-5895
Omnibox UI Spoofing Vulnerability in Google Chrome iOS Prior to
Publication date: 2026-04-08
Last updated on: 2026-04-13
Assigner: Chrome
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| chrome | to 147.0.7727.55 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-451 | The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an incorrect security user interface issue in the Omnibox (URL bar) of Google Chrome on iOS versions prior to 147.0.7727.55. It allows a remote attacker to spoof the contents of the Omnibox by using a crafted domain name, making it appear as if the browser is displaying a different URL than the actual one.
How can this vulnerability impact me? :
The vulnerability can impact users by misleading them about the actual website they are visiting. Since the Omnibox can be spoofed, users might be tricked into believing they are on a legitimate site when they are actually on a malicious one, potentially leading to phishing attacks or other security risks.