The flaw stems from insufficient validation of untrusted information entered into WebShare. A remote attacker who has already managed to compromise the renderer process can supply a malicious HTML page that causes the browser’s user interface to display deceptive content. The effect is UI spoofing, which could mislead users into interacting with a page that appears legitimate while it is not. The vulnerability is classified as CWE‑20 (Improper Input Validation).

Google Chrome for Android versions earlier than 150.0.7871.47 are affected. The CVE description does not reference desktop releases or other browsers, so only Android deployments are known to be vulnerable.

The CVSS base score of 3.1 indicates a low severity overall. The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting a very low probability of exploitation. The requirement that the attacker already compromise the renderer process further limits the attack surface, making this vulnerability less concerning than a fully remote code execution flaw. However, applications that rely heavily on WebShare should still assess potential UI spoofing risks.