Chrome’s Contact Picker UI can be rendered incorrectly, allowing a remote attacker to display a spoofed interface when a user visits a crafted web page. This flaw is classified as medium severity, indicating that the attacker can impersonate the legitimate permission prompt but cannot bypass other browser security controls. The primary effect is that users may be misled into granting contact access to unwanted sites.

The vulnerability affects Google Chrome on Android versions earlier than 149.0.7827.53. Devices running any older builds are susceptible; the June 2026 security update addresses the UI rendering issue.

Exploitation requires the victim to open a crafted HTML page in Chrome, making it a social‑engineering attack. The CVSS score of 8.8 categorizes this as a high severity vulnerability. The CVE does not provide evidence of publicly available exploits, and the vulnerability is not listed in CISA’s KEV catalog. The EPSS score is below 1%, indicating a very low probability of exploitation. The attacker controls what the spoofed UI displays, which could deceive users into submitting contact information, but no automatic elevation of privileges is possible.