UI misrepresentation in Chrome’s TrustedWebActivities on Android allows a remote attacker to craft an HTML page that displays a spoofed address bar. By tricking users into believing they are on a legitimate site, the attacker can facilitate credential theft or other social‑engineering attacks. The weakness is an UI spoofing flaw, classified as CWE‑451, which undermines the integrity of the address bar interface and potentially exposes user data.

Google Chrome for Android versions prior to 156.0.8078.47 are impacted. The vulnerability resides in the TrustedWebActivities component and affects all Android devices running these builds. Users on newer builds are not affected.

The CVSS score of 8.8 indicates high severity. The EPSS score of < 1% suggests that widespread exploitation is currently unlikely, yet the vulnerability is already usable via a remote HTML payload. It is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by hosting a crafted page and luring users through phishing emails or malicious adverts; the attack vector is remote web‑based and requires only that the victim opens the page in Chrome. The flaw enables social engineering rather than direct code execution but still poses a high risk if the user is deceived.