The vulnerability arises from insufficient validation of untrusted input in the mobile version of Google Chrome on Android. A local attacker can craft a malicious file that, when opened, causes Chrome’s omnibox (URL bar) to display spoofed text and URLs. This misleads the user into believing they are interacting with a legitimate web address, potentially enabling phishing or social‑engineering attacks. The weakness maps to Improper Input Validation and Sensitive Data Exposure (CWE-20, CWE-1289). The description indicates a local‑only attack that requires the attacker to place the file on the device or otherwise entice the user to open it.

Google Chrome on Android versions prior to 151.0.7922.72 is affected. Updating or installing a newer Chrome release that includes the security fix will remove the vulnerability.

The CVSS score of 3.3 qualifies the issue as Medium, and the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. Because the attack vector is local, the risk to remote users is minimal, and the vulnerability is not listed in the CISA KEV catalog. However, users with access to play or download files on a device that runs an outdated Chrome version could be tricked into opening a crafted file that results in UI spoofing.