Insufficient validation of untrusted input in the Payments module of Chrome on Android allows a remote attacker who has already compromised the renderer process to trigger UI spoofing by delivering a crafted HTML page. The attacker can alter the user interface presented by the browser, for example by modifying payment prompts displayed within the Chrome interface. The flaw is confined to the presentation layer and does not directly compromise system integrity or confidentiality.

Google Chrome for Android releases older than 151.0.7922.72 are affected. All Android devices that have not yet received the stable channel update mentioned in the Chromium release announcement are vulnerable.

The CVSS score of 4.2 classifies the issue as medium severity, while the EPSS score of less than 1% and absence from the CISA KEV catalog suggest a low likelihood of widespread exploitation. Exploitation requires prior compromise of the renderer process, a condition that is unlikely to be satisfied by a network‑only attack, thereby keeping overall risk low in typical environments.