The vulnerability arises from insufficient randomness used in notification UI elements in Chrome for Android versions earlier than 156.0.8078.47. A remote attacker can craft a malicious HTML page that can spoof notification interfaces, leading to potential phishing or deceptive user interactions. The flaw stems from relying on predictable values to render notification content, enabling the attacker to predict and manipulate the display of UI components and impersonate legitimate UI elements, potentially facilitating social engineering or credential theft.

Google Chrome on Android, any version prior to 156.0.8078.47. Devices running an older Chrome installation are susceptible, regardless of the Android OS version.

The CVSS score of 8.8 signals a high severity vulnerability. The EPSS score of < 1% indicates a very low but nonzero likelihood of exploitation. The lack of a KEV listing does not diminish the potential impact. Based on the description, it is inferred that the attack vector is remote and relies on a maliciously crafted web page that triggers the flaw in the notification system. A successful exploitation would grant the attacker the capability to deceive users by imitating legitimate UI elements, potentially leading to credential theft or other social engineering attacks.