UI misrepresentation in Google Chrome for Android before version 156.0.8078.47 permits a remote attacker to craft an HTML page that presents deceptive UI elements. When a user interacts with these elements, the attacker may induce unintended actions, such as submitting credentials or engaging with malicious content, through social engineering. The underlying weakness is an input validation failure (CWE‑451).

Users who run the Google Chrome Android application on any Android device with Chrome older than 156.0.8078.47 are vulnerable. The fault resides in the standard desktop channel builds of Chrome for Android released prior to that version; no OEM or device‑specific distinctions are noted.

The CVSS score of 8.8 marks the flaw as high severity. The EPSS score of < 1% suggests a very low but non‑zero probability of real‑world exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a victim to open a malicious web page in the affected browser, with social engineering as the principal attack vector.