UI misrepresentation within Chrome’s WebAppInstalls component on Android before version 156.0.8078.47 allows a remote attacker to spoof user interface elements through a maliciously crafted HTML page, using social engineering. The flaw can trick users into interacting with UI elements that do not reflect the true operation, potentially exposing sensitive information or enabling unintended actions. This is identified as a UI spoofing and information exposure weakness (CWE-451), compromising user interaction integrity.

Google Chrome for Android versions earlier than 156.0.8078.47 are affected. The vulnerability exists in the Android Chrome builds and may impact any device running the old Chrome build where WebAppInstalls is enabled. Devices must be checked for installed Chrome versions to determine exposure.

The vulnerability is rated Medium with a CVSS score of 6.5, an EPSS of less than 1%, and it is not listed in CISA’s KEV catalog. The attack can be launched remotely by delivering a crafted HTML page that employs social engineering to trick users into interacting with UI elements that do not match the intended operation. Although no public exploits are known, the simplicity of the exploit path means an attacker could potentially trick users into revealing credentials or accepting unintended transactions. Overall, the risk remains moderate but non‑negligible for systems running out‑of‑date Chrome on Android.