The CVE is caused by an incorrect security user interface in Google Chrome’s Document Picture‑in‑Picture (PIP) mode on Android. A remote attacker can craft an HTML page that, when opened in the browser, triggers the PIP window and causes Chrome to display forged security indicators, making a malicious domain appear legitimate. The weakness is identified as CWE‑451. Based on the description, it is inferred that the attacker must host a malicious HTML page that the user visits to trigger the PIP window.

Google Chrome for Android is older than version 150.0.7871.47 and supporting the PIP feature are vulnerable. The description focuses solely on the PIP mode, and no impact on other Chrome components is mentioned, so the issue is limited to that feature.

The CVSS score of 4.3 and the EPSS score of less than 1% suggest a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker delivering a crafted HTML page that must be accessed by the user to trigger PIP; the attack is remote and depends on user interaction. While no active exploitation has been reported by displaying counterfeit security indicators, potentially leading to phishing or credential compromise.