UI misrepresentation in the WebAppInstalls component of Google Chrome for Android prior to 156.0.8078.47 allows an attacker who can co‑install a malicious application to spoof Chrome UI elements. The attack requires the user to first install a secondary app, typically through social engineering. Because the spoofed UI is rendered by Chrome itself, the user may unknowingly provide sensitive information or consent to actions, potentially leading to data exposure or enabling further compromise.

The vulnerability affects Google Chrome for Android versions prior to 156.0.8078.47. All users running those earlier builds are at risk, regardless of device make or OS version, until the patch is applied.

The CVSS score of 9.6 indicates critical risk, but the EPSS score is under 1% and the vulnerability is not listed in the CISA KEV catalog. The flaw requires a local attacker with the ability to co‑install an app and user interaction, typically through social engineering. The attack vector is local; remote exploitation is not possible. The high CVSS reflects the severe impact a successful spoof can have, potentially leading to data loss or further compromise.