The flaw is caused by UI misrepresentation in the OmniBox of Google Chrome on Android. A remote attacker can create a malicious HTML page that causes the address bar to display deceptive information, effectively spoofing the OmniBox. When the victim navigates to or enters the crafted page, the user is misled into believing they are on a legitimate site, a risk that could lead to credential theft or other social‑engineering attacks. The weakness is rooted in improper input validation in the UI rendering path (CWE‑451).

Google Chrome for Android on any version older than 156.0.8078.47.

The vulnerability has a high CVSS score of 8.8, but the EPSS score is very low (<1 %) indicating that exploitations are rare at this time. The flaw can be triggered remotely by delivering a crafted HTML page; no additional privileges or user interaction beyond opening the content are required. Although the description does not detail arbitrary code execution, the attacker can manipulate the user experience to facilitate phishing or credential harvesting. The absence from the CISA KEV catalog suggests that no widespread exploitation has been observed.