The flaw enables a maliciously crafted HTML page to misrepresent the address bar in Google Chrome on Android devices running versions before 156.0.8078.47. It stems from a UI misrepresentation in the Text module and permits an attacker who has already compromised the renderer process to display a spoofed URL to the user. The official description does not assert that this flaw provides arbitrary code execution; that consequence is an inference only.

Google Chrome for Android versions earlier than 156.0.8078.47, covering all builds of the browser up to that version.

The CVSS score of 8.8 indicates a high‑severity vulnerability, though the EPSS score is below 1% and it is not listed in CISA’s KEV catalog, suggesting low exploitation pressure to date. Exploitation would likely involve a drive‑by visit to a malicious site that delivers a crafted page; because it requires a compromised renderer, the attack vector is considered indirect. The flaw can be leveraged to facilitate phishing or social‑engineering attacks, potentially leading to credential theft if the user trusts the spoofed address bar.