Missing authorization in Actor in Google Chrome on Android prior to 156.0.8078.47 allowed a local attacker to spoof user interface elements via a co‑installed app. The flaw originates from insufficient access control (CWE-862) that permits an app to overlay or mimic Chrome UI, potentially deceiving users into giving sensitive information. This vulnerability does not enable remote code execution but can enable phishing or credential harvesting within the browser context. Chromium security severity is low, indicating a limited exploitation likelihood.

Google Chrome for Android versions earlier than 156.0.8078.47 are impacted. The Actor component resides in the browser and is relevant to all Android devices running the affected Chrome releases.

The CVSS score of 8.8 indicates high severity, yet the EPSS score of <1% suggests a very low likelihood of real‑world exploitation at this time. The vulnerability is not listed in CISA KEV. Exploitation requires a locally privileged attacker to install or have a co‑installed app that can grant overlay permissions on the device; once the attacker succeeds, they can manipulate Chrome UI but cannot escape to execute arbitrary code or affect the underlying OS. The attack vector is local and depends on sideloaded or pre‑installed applications.