Google Chrome on Android allows a remote attacker to craft an HTML page that misrepresents shopping UI elements, enabling spoofing of visual cues. This UI spoofing can mislead users into interacting with fraudulent content. The manipulation is limited to the Chrome Shopping feature and does not affect other browser components.

Any device running Google Chrome on Android with a version older than 157.0.8103.38 is affected. The vulnerability is limited to the Chrome Shopping feature and does not impact other Chrome components. Updating to 157.0.8103.38 or later resolves the issue for all affected Android releases.

The CVE is rated medium in Chromium’s security severity. No EPSS score is available. The vulnerability can be exploited remotely through a crafted web page that must be loaded by the victim. The lack of a KEV listing suggests no confirmed mass exploitation yet. The problem does not involve denial-of-service or code execution and is confined to UI spoofing in the Shopping feature.