CVE-2026-5906
Omnibox UI Spoofing Vulnerability in Google Chrome Android
Publication date: 2026-04-08
Last updated on: 2026-04-14
Assigner: Chrome
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| chrome | to 147.0.7727.55 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-451 | The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an incorrect security user interface issue in the Omnibox (URL bar) of Google Chrome on Android devices running versions prior to 147.0.7727.55. It allows a remote attacker to spoof or fake the contents of the Omnibox by using a specially crafted HTML page.
How can this vulnerability impact me? :
The vulnerability can impact users by misleading them about the actual URL they are visiting. Since the Omnibox can be spoofed, users might be tricked into believing they are on a legitimate website when they are actually on a malicious one, potentially leading to phishing attacks or other security risks.