{"id":"CVE-2026-121110","kind":"vulnerability","aliases":["CVE-2026-121110"],"related":[],"title":"Chrome for Android: Shopping UI can be spoofed by a crafted page","description":"UI misrepresentation in Shopping in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","summary":"A crafted HTML page can make elements of the Shopping feature in Google Chrome on Android display misleading content. The sources describe UI spoofing only, with no code execution or data theft stated.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","chrome","mobile","runtime"],"not_affected_if":["chrome-updated","shopping-feature-unused"],"how_to_check":"- Open Chrome on Android and check the version under Settings > About Chrome\n- Confirm whether the installed version is below `157.0.8103.38`","fix":"- Google Chrome for Android: `157.0.8103.38` or later","status":"open","published_at":"2026-11-03T21:17:17+00:00","first_seen_at":"2026-11-03T21:19:15+00:00","triaged_at":"2026-11-03T21:25:08+00:00","updated_at":"2026-11-03T21:25:08+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-03T21:25:08Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome for Android: `157.0.8103.38` or later","reach":"internet","title":"Chrome for Android: Shopping UI can be spoofed by a crafted page","impact":"low","summary":"A crafted HTML page can make elements of the Shopping feature in Google Chrome on Android display misleading content. The sources describe UI spoofing only, with no code execution or data theft stated.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["chrome","android","mobile"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker spoofs on-screen UI elements to mislead the user","analyst_note":"","how_to_check":"- Open Chrome on Android and check the version under Settings > About Chrome\n- Confirm whether the installed version is below `157.0.8103.38`","plain_action":"Update Google Chrome on your Android phone to version 157.0.8103.38 or later.","needs_analyst":false,"not_affected_if":["chrome-updated","shopping-feature-unused"],"who_is_affected":"People using Chrome on Android with the Shopping feature in versions before 157.0.8103.38. The sources describe a crafted HTML page as the trigger, so visiting an untrusted site is the exposure path. Desktop Chrome and other platforms are not mentioned in the sources.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000666,"input_tokens":4105,"output_tokens":512,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121110':15A,18A '-2026':14A,17A '157.0.8103.38':68C 'allow':69C 'android':3A,19B,38B,65C 'attack':72C 'chrome':1A,20B,36B,62C 'chromium':82C 'code':50B 'content':41B 'craft':11A,24B,79C 'cve':13A,16A 'data':53B 'describ':44B 'display':39B 'element':29B,76C 'execut':51B 'featur':33B 'googl':35B,61C 'html':25B,80C 'make':28B 'medium':85C 'mislead':40B 'misrepresent':57C 'mobil':21B 'page':12A,26B,81C 'prior':66C 'remot':71C 'runtim':22B 'secur':83C 'sever':84C 'shop':4A,32B,59C 'sourc':43B 'spoof':8A,46B,74C 'state':55B 'theft':54B 'ui':5A,45B,56C,75C 'via':77C","nicknames":[],"mitigations":[],"who_affected":"People using Chrome on Android with the Shopping feature in versions before 157.0.8103.38. The sources describe a crafted HTML page as the trigger, so visiting an untrusted site is the exposure path. Desktop Chrome and other platforms are not mentioned in the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Google Chrome on your Android phone to version 157.0.8103.38 or later.","pkeys":[],"ptokens":[],"labels":["android","chrome","medium","mobile","runtime"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121110","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121110","severity":null,"published_at":"2026-11-03T21:17:17+00:00","modified_at":"2026-11-03T21:17:18+00:00","first_seen_at":"2026-11-03T21:19:15+00:00","fetched_at":"2026-11-03T21:19:15+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}