Security readout for executives and security teams
Plain-English summary
CVE-2026-0901 is a Chrome on Android UI spoofing issue in Blink. A malicious web page could mislead a user about what they are seeing or interacting with. It requires user interaction and does not directly enable code execution, but it can support phishing or consent trickery. No public source provided indicates active exploitation.
Executive priority
Prioritize through normal mobile browser patch management. Escalate for workforces heavily using Android devices or exposed to phishing risk. This is not currently evidenced as actively exploited, but browser UI spoofing can undermine user trust and support credential theft scenarios.
Technical view
The CVE describes an inappropriate implementation in Blink affecting Google Chrome on Android before 144.0.7559.59. Remote attackers can trigger UI spoofing using crafted HTML. CVSS 3.1 is 5.4 with network access, low complexity, no privileges, required user interaction, and low confidentiality and integrity impact. Chromium severity is listed as High.
Likely exposure
Organizations with Android devices running Chrome versions earlier than 144.0.7559.59 may be exposed. Exposure depends on mobile browser update posture and whether users can access untrusted web content.
Exploitation context
The attack requires a user to visit or interact with a crafted web page. Provided sources do not state exploitation in the wild, and the CVE is not marked in KEV. The main risk is deceptive interface behavior that could facilitate phishing or unsafe user decisions.
Researcher notes
Evidence is limited to the CVE record, Chromium issue reference, and Chrome release blog reference. The CVE states Chrome on Android before 144.0.7559.59, while the provided blog URL title references desktop; verify vendor release notes for Android-specific rollout timing.
Mitigation direction
- Update Chrome on Android to 144.0.7559.59 or later where available.
- Use managed mobile policies to enforce Chrome updates on Android devices.
- Review Google Chrome release guidance for platform-specific update details.
- Reduce exposure to untrusted links through mobile phishing protections.
Validation and detection
- Inventory Android devices and installed Chrome versions.
- Flag Chrome on Android versions earlier than 144.0.7559.59.
- Confirm managed devices receive Chrome updates successfully.
- Review mobile security telemetry for suspicious web-based phishing events.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-451: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-0901 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N2.82.5Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.4MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://chromereleases.googleblog.com/2026/01/stable-channel-update-for-desktop_13.htmlCVE reference
- https://issues.chromium.org/issues/40057499CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
User Interface (UI) Misrepresentation of Critical Information
User Interface (UI) Misrepresentation of Critical Information represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.