Improper state validation in the Autofill AI feature of Google Chrome on Android allows a remote attacker to spoof user interface elements through a specially crafted web page. By forging UI components, the attacker can trick users into revealing credentials or providing other sensitive information, effectively creating a phishing scenario. The underlying weakness is a lack of sufficient validation for UI rendering states, enabling malicious page authors to manipulate the appearance of the browser’s autofill prompts.

The vulnerability affects Google Chrome on Android consumer devices. Any Chrome installation on Android with a version earlier than 155.0.8059.39 is susceptible. No evidence suggests that Chrome for Desktop is impacted.

The CVSS score of 5.4 indicates a medium severity, meaning the flaw can lead to phishing but does not provide a direct path to arbitrary code execution. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that known exploits have not been observed or widely used. The likely attack vector is a remote attacker delivering a malicious web page that targets users of the affected Chrome version. Because the exploit requires only standard web content delivery, it could be attempted by any attacker with access to a user’s internet connection, which raises concern for users of older Chrome releases.