A remote attacker can create a crafted HTML page that, when opened in Google Chrome on Android, causes the browser to display UI elements that mimic legitimate interface components. This UI misrepresentation can trick users into clicking on false controls or entering credentials, effectively facilitating phishing or other social engineering attacks. The weakness is classified as CWE‑451, indicating a missing or disregarded warning about an unexpected UI change.

Google Chrome for Android mobile browsers, versions earlier than 157.0.8103.38. The vulnerability is limited to the mobile UI rendering path.

The CVE is rated low in severity and currently lacks an EPSS score; it is not listed in the CISA KEV catalog. The likely attack vector requires the victim to visit a maliciously crafted web page, which can be achieved through typical phishing or social engineering methods. Because the exploit targets UI rendering rather than underlying code execution, the attack is straightforward for a motivated attacker but does not provide direct code execution or elevated privileges.