An incorrect security user interface in Google Chrome on Android versions prior to 151.0.7922.72 allows a remote attacker to craft a malicious HTML page that tricks the browser into displaying a falsified domain name. This domain spoofing can be used to deceive users into believing they are interacting with a legitimate site, enabling phishing or other social‑engineering attacks. The vulnerability does not provide direct code execution or data exfiltration but poses a risk to user confidentiality by misrepresenting website identity.

Any Android device running Google Chrome versions older than 151.0.7922.72. The issue is specific to the Chrome browser shipped on Android platforms, affecting all users who have not updated their browser to the latest stable release.

The CVSS score is 4.3, placing the vulnerability in the lower severity range, and the EPSS score is below 1%, indicating a very low probability of exploitation in the current period. It is not listed in the CISA KEV catalog. The likely attack vector involves a remote adversary hosting a crafted web page that a targeted user visits; the exploit requires user interaction and is browser‑based, so it is somewhat bounded but still exploitable under the right conditions.