A flaw in Google Chrome’s CustomTabs on Android allows a remote attacker to render UI elements that do not match the true content, enabling a user to be misled into interacting with deceptive interface components. The issue is categorized as CWE‑451, indicating that the application incorrectly models the user interface. This misrepresentation can be exploited to trick users into divulging sensitive information or confirming actions they would otherwise refuse.

Google Chrome for Android versions earlier than 152.0.7977.65 are affected. The vulnerability applies to any build of Chrome that uses CustomTabs prior to the specified update, including older stable channel releases.

Chromium rates the flaw as medium severity with a CVSS score of 5.4 and there is no known public exploit yet. The EPSS score is < 1% and the vulnerability is not listed in CISA KEV, implying a lower attack probability from the perspective of national‑level adversaries. The likely attack vector requires a remote attacker to craft a malicious webpage that opens via CustomTabs; once a user loads this page and interacts with the spoofed UI, the attacker can achieve the intended deception. Given the medium assessment, patching is the recommended course of action to eliminate the risk.