The vulnerability allows a remote attacker to present a malicious web page that tricks a user into interacting with hidden UI elements in the Chrome Messages component on Android. By overlaying spoofed buttons or links, the attacker can cause the user to perform unintended actions, such as opening links, sending messages, or authorizing actions without the user's knowledge. The flaw is a classic clickjacking issue (CWE‑1021) and does not provide direct code execution or data exfiltration but can enable social‑engineering attacks and compromise the integrity of user interactions.

Google Chrome for Android versions before 155.0.8059.39 are affected. This includes all builds of the Chrome app on Android devices that have not yet been updated to the 155.0.8059.39 release.

The CVSS score is listed as Medium, and the EPSS score is not available, while the vulnerability is not yet listed in CISA KEV. The attack requires the victim to visit a crafted HTML page, typically from a malicious website or a malicious link shared via messaging. Because the flaw is limited to user‑interface manipulation, exploitation is social‑engineering‑based and does not require elevated privileges. Given the lack of a public exploit, the current risk is moderate but should be mitigated promptly to prevent accidental user compromise.