The vulnerability is a UI misrepresentation in the Messages component of Google Chrome on Android that allows a malicious actor to spoof user interface elements via a crafted HTML page. By delivering such a page, an attacker can trick a user into interacting with a fake UI, potentially leading to phishing or other manipulation. The flaw is linked to CWE‑451, indicating a deficiency in post‑condition checks.

Google Chrome on Android devices running any version before 156.0.8078.47 is affected; no specific device or build is identified, so all Android machines with Chrome in that version range are potentially vulnerable.

The CVSS score of 8.8 marks it as high severity, but the EPSS score of <1% reflects a low likelihood that it is being actively exploited today, and it is not listed in CISA's KEV catalog. The attack vector is inferred to be a crafted HTML page accessed over the network, such as through a malicious website or phishing email. Until a patch is installed, users are at risk of being deceived by spoofed UI and possibly exploited for phishing or other malicious interactions.