The vulnerability involves a UI misrepresentation in the Chrome Toolbar component on Android devices prior to 156.0.8078.47. A crafted HTML page can spoof the address bar, tricking users into believing they are on a legitimate site. This flaw does not provide direct code execution but enables phishing attacks, and the weakness is categorized as CWE‑451.

Android devices running Google Chrome versions prior to 156.0.8078.47 are vulnerable. Devices that have not applied the latest stable channel updates remain at risk and lack the protection applied in newer releases.

The CVSS score of 8.8 highlights high potential impact. Though the EPSS score is less than 1% and the issue is not listed in KEV, the nature of the flaw—allowing a remote attacker to spoof the address bar via crafted web content—makes it an attractive target for phishing. The likely attack vector is a remote attacker serving malicious web content that includes the crafted HTML. Successful exploitation requires the user to visit the site, so user vigilance in accessing unknown pages can mitigate risk until a patch is applied.