The flaw lies in the Credential Management subsystem of Android Chrome and allows a remote attacker to craft a malicious HTML page that displays a forged user interface. The deception can mislead a user into interacting with a credential prompt that is not authentic to Google Chrome, potentially causing the user to enter sensitive information or submit data to an attacker. The vulnerability does not directly expose stored credentials or elevate privileges.

Google Chrome for Android versions earlier than 150.0.7871.47 are affected. Any build of the Chrome browser on Android devices that predates this version is vulnerable to the UI‑spoofing exploit.

The CVSS score of 4.3 indicates medium severity while the EPSS score of less than 1% indicates a low probability of exploitation. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires only the delivery of a crafted HTML page to the victim, which a remote attacker can achieve through a malicious website or a compromised network resource. No privileged access is needed on the target device, and the attack vector is remote via network traffic.