A crafted HTML page can cause Chrome for Android to display a false address bar when the browser is in fullscreen mode. This UI misrepresentation, classified as CWE‑451, deceives users into believing they are on a legitimate site, allowing an attacker to phish credentials or deliver social‑engineering attacks. The flaw does not lead to code execution or direct system compromise; its impact is limited to user deception and potential credential theft.

Google Chrome for Android versions earlier than 155. The issue manifests on all devices running those legacy builds when the browser enters fullscreen mode.

The exploit is remote and requires a user to visit a maliciously crafted page that requests fullscreen. The CVSS score of 5.4 indicates moderate severity, while the EPSS score is not available and the vulnerability is not listed in CISA KEV. No widespread exploitation has been reported. The Chromium severity assessment is low, reflecting the social‑engineering nature of the attack. Dynamic resolution of the URL bar is vulnerable only when fullscreen is enabled, which limits the attack surface. Consequently, the overall risk to users is considered moderate for general users and low for highly targeted campaigns.