---
id: "CVE-2026-121110"
kind: "vulnerability"
aliases: ["CVE-2026-121110"]
title: "Chrome for Android: Shopping UI can be spoofed by a crafted page"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["android", "chrome", "mobile", "runtime"]
not_affected_if: ["chrome-updated", "shopping-feature-unused"]
published_at: "2026-11-03T21:17:17+00:00"
first_seen_at: "2026-11-03T21:19:15+00:00"
updated_at: "2026-11-03T21:25:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121110", "first_seen_at": "2026-11-03T21:19:15+00:00"}]
---

# Chrome for Android: Shopping UI can be spoofed by a crafted page

A crafted HTML page can make elements of the Shopping feature in Google Chrome on Android display misleading content. The sources describe UI spoofing only, with no code execution or data theft stated.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Open Chrome on Android and check the version under Settings > About Chrome
- Confirm whether the installed version is below `157.0.8103.38`

## Fix

- Google Chrome for Android: `157.0.8103.38` or later

## Timeline

- 2026-11-03T21:19:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121110

## From the sources

UI misrepresentation in Shopping in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_