An inappropriate implementation in Chrome’s accessibility subsystem allows a remote attacker to craft a malicious HTML page that can spoof the user interface on Android devices. By loading this page in the browser, the attacker can misleadingly present content or controls so that the user believes they are interacting with a legitimate application screen. This flaw could be used to phish credentials or otherwise manipulate user actions, representing a high‑severity impact on confidentiality and integrity of user data.

The flaw is present in Google Chrome for Android versions prior to 149.0.7827.53. All installations of Chrome on Android running an older revision are affected; the June 2026 stable channel update contains the patch.

Chromium labels the weakness as high severity, but the EPSS score is not provided and the vulnerability is not yet listed in CISA’s KEV catalog, indicating no confirmed widespread exploits. The likely attack vector is a remote attacker delivering the malicious page through a web server or email link; no local privilege is required. The absence of a KEV listing suggests the risk of exploitation is currently lower, though the potential impact justifies timely remediation.