An incorrect security UI in Google Chrome for Android permits a remote attacker to perform UI spoofing by serving a crafted HTML page. This flaw explains how the browser can display forged interface elements that mimic legitimate controls, potentially misleading users into entering credentials or interacting with malicious content. The vulnerability does not provide arbitrary code execution or direct system compromise, but it can lead to the theft of sensitive user input when the spoofed UI is trusted by the user.

The vulnerability affects all installations of Google Chrome on Android that run a version earlier than 150.0.7871.47. Versions equal to or newer than 150.0.7871.47 incorporate the fix and are not susceptible to this UI spoofing issue.

Chromium describes the bug as Medium severity with a CVSS score of 4.3. The EPSS score is below 1% and it is not listed in the CISA KEV catalog. The attack requires an attacker‑controlled HTML page to be delivered and viewed by a user, making the vector remote but dependent on user interaction. Because the flaw can enable credential theft or other deceptive phishing attacks, the overall risk is moderate; immediate patching is advisable to mitigate potential exploitation.