Executive brief
A vulnerability in Google Chrome for Android could allow a malicious website to misrepresent its identity. By exploiting a timing issue in the Picture-in-Picture feature, an attacker could trick users into believing they are interacting with a legitimate website when they are actually on a fraudulent one. This type of spoofing is often used in phishing attacks to steal sensitive user information.
Technical details
A race condition exists within the Picture-in-Picture (PiP) implementation of Google Chrome on Android. By leveraging a specially crafted HTML page, a remote attacker can exploit this timing vulnerability to bypass origin display protections, leading to domain spoofing. The vulnerability is triggered when the browser fails to correctly synchronize the state of the PiP window with the actual site origin during specific transitions. This allows an attacker to present a fraudulent UI that appears to belong to a different domain. The issue is addressed in version 151.0.7922.72.
Affected products
- Google Chrome prior to 151.0.7922.72
Timeline
- 2026-07-29: patched: Fixed in Chrome for Android version 151.0.7922.72
- 2026-07-30: disclosed