The vulnerability is a UI misrepresentation in the Android version of Google Chrome before 155.0.8059.39. A crafted HTML page can cause Chrome to display spoofed UI elements, allowing a remote attacker to trick users into interacting with content that does not match the intended interface. The flaw is classified as a low severity issue by Chromium, but it can undermine user trust and facilitate social engineering attacks.

Google Chrome running on Android devices prior to release 155.0.8059.39 is affected. Any user who installs an outdated version of Chrome on Android is potentially vulnerable.

The attack vector is remote; the attacker needs to host or deliver a crafted HTML page that the user opens or visits. Because the flaw is only present in the UI rendering engine, it does not provide code execution or privilege escalation. The EPSS score is not available and the vulnerability is not listed in CISA KEV, but the CVSS score of 5.4 suggests a moderate risk. Nonetheless, a malicious web page could exploit the spoof to conduct phishing or other UI deception tactics.