The vulnerability is caused by an incorrect implementation of the security UI for downloads in Google Chrome on Android devices before version 146.0.7680.71. A remote attacker can craft a malicious HTML page that, when visited by a user, triggers the Chrome Downloads UI with misleading information, allowing the attacker to spoof the download dialog. As a result, users may be forced to download or interact with unwanted or malicious content. This flaw exploits the weakness categorized as CWE-451.

The issue affects Google Chrome for Android prior to version 146.0.7680.71 (see cpe entries for google:chrome on Android). The problem is specific to Android; other platforms such as macOS, Linux, and Windows are not impacted according to the provided CPE list.

The CVSS score is 6.5, indicating moderate severity, while the EPSS score is below 1%, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, further indicating low exploitation activity. The attack vector is remote, requiring the victim to open a crafted HTML page in Chrome on Android. Because it is a UI spoofing flaw, an attacker cannot directly achieve code execution but can potentially lure a user into downloading malicious content, leading to indirect compromise.