An incorrect security UI in Google Chrome for Android, before version 144.0.7559.59, can be exploited by a remote attacker to spoof the contents of the Omnibox using a crafted HTML page. The attacker can cause a user to believe they are viewing a legitimate site while in fact the browser is displaying a false address, enabling phishing or credential‑stealing attacks. The flaw carries a CVSS score of 9.8, indicating high severity for confidentiality and integrity compromise.

Google Chrome for Android, versions earlier than 144.0.7559.59. Users of Android devices running these versions are affected. No other products or OS versions are specifically listed as impacted by this issue.

The CVSS score reflects severe risk, but the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog. The attack requires an attacker to serve a malicious web page that the user visits; once the crafted HTML is rendered, the Omnibox UI can be spoofed. Because the flaw resides in the browser’s security UI, it can potentially affect all users browsing via Chrome on affected Android devices.