This vulnerability arises from a type confusion bug in the FullScreen feature of Google Chrome on Android devices running versions prior to 156.0.8078.47. The flaw permits a remote attacker to spoof UI elements via a crafted HTML page, potentially resulting in misleading visual displays that could deceive users. The impact is the ability to display false interface elements that may be used for phishing or tricking users into unintended actions. The weakness is classified as CWE‑451. The CVSS score of 8.8 reflects a high level of risk given the potential for deceptive interactions.

Affected products are Google Chrome for Android prior to version 156.0.8078.47. All Android installations of Chrome on these versions are vulnerable when a user renders a malicious HTML page. No particular device model or Android OS version is singled out beyond the Chrome app revision.

The CVSS score of 8.8 remains high, but the EPSS score of <1% indicates limited public exploitation data. The vulnerability is not listed in CISA KEV, suggesting no widespread incidents to date. An attacker must craft an HTML document and convince a user to load it in a vulnerable Chrome instance; once the page is rendered, the type confusion can be triggered, allowing the attacker to display spoofed UI elements that could mislead the user. Additional conditions include the browser executing the affected code path and the attacker’s crafted HTML being delivered over a network or local storage where the user can access it.