The flaw resides in Blink, the rendering engine of Google Chrome on Android, where a specially crafted HTML page can convince the browser to display counterfeit user interface elements. This UI spoofing can mislead users into interacting with deceptive controls, potentially resulting in credential leakage or unintended actions, yet it does not require any code execution or privileged access. The weakness is cataloged as CWE‑451, reflecting a failure to enforce expected security properties for user interfaces.

The vulnerability affects Google Chrome on Android versions older than 144.0.7559.59. Desktop builds of Chrome on Windows, macOS, Linux, and other operating systems are not impacted. Users running any Chrome variant other than the affected Android releases remain safe.

The CVSS base score of 5.4 indicates a moderate severity. An EPSS score of less than 1 % suggests a very low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. An attacker would need a user to visit a malicious or phishing web page; the attack vector is limited to content delivered over HTTP/HTTPS and does not provide direct code execution or privilege escalation.