Google Chrome for Android prior to 156.0.8078.47 contains a flaw in its Prompts component that allows a local attacker to craft a co‑installed application that abuses a memory corruption to produce UI misrepresentation. This lets the attacker spoof Chrome dialog elements, tricking users into interacting with interfaces that appear legitimate. The weakness is identified as CWE‑451 and reflects improper data handling that permits attackers to manipulate the user interface display.

Google Chrome for Android, any version earlier than 156.0.8078.47, as listed in the Chrome release advisory. No other browsers or platforms are indicated as affected by this issue.

The CVSS score of 9.6 indicates a high‑severity vulnerability. EPSS is low (<1%), meaning exploitation has not yet been widely observed. The flaw is not listed in the CISA KEV catalog. The attack vector is local: a malicious co‑installed application, leveraging social engineering, can spoof UI elements and lure users into interacting with the fake prompts. While the underlying memory corruption could theoretically be leveraged for code execution, the current public description does not confirm that capability, and the risk is primarily the ability to manipulate user interactions to facilitate further attacks.