Chromium’s accessibility subsystem contains an inappropriate implementation that allows a remote attacker to deliver a crafted HTML page and perform UI spoofing on Android devices. When the page is opened in Chrome, the browser displays misleading controls or interfaces that mimic legitimate application screens, potentially tricking users into revealing sensitive information. The flaw is captured as CWE‑451 and CWE‑1021 and is rated as High by Chromium.

The vulnerability applies to Google Chrome on Android platforms that have not yet received the June 2026 stable channel update. The CVE information does not specify individual version numbers, so all installations of Chrome for Android prior to the latest update remain potentially vulnerable.

Chromium assigns a CVSS score of 5.4, indicating a medium risk level, while the EPSS score is < 1%, suggesting a low probability of exploitation. The flaw is not listed in CISA’s KEV catalog. The likely attack vector is a remote attacker delivering the malicious page through a web server, email link, or other internet content, with no local privilege escalation required. Although exploitation is considered unlikely, the impact of UI spoofing justifies timely remediation.