A UI misrepresentation flaw in the Autofill feature of Google Chrome on Android prior to version 156.0.8078.47 permits a remote attacker to craft an HTML page that spoofs the browser address bar. This manipulation can trick users into believing they are interacting with a legitimate site, potentially leading to credential theft or phishing. The weakness aligns with improper information exposure (CWE‑451).

The vulnerability affects Google Chrome on Android devices running any browser build prior to 156.0.8078.47. All Android installations of Chrome—whether consumer or managed—are potentially exposed until the security patch is applied.

The flaw has a CVSS score of 8.8, indicating high severity. The EPSS score is <1%, indicating a very low but nonzero probability of exploitation; however, the vulnerability can be triggered via a remote HTML payload, making it remotely exploitable. The issue is not listed in the CISA KEV catalog at this time. Attackers with web access to affected devices could craft a malicious page that tricks users into interacting with a spoofed address bar, potentially leading to credential theft or phishing.