The vulnerability is a UI misrepresentation in the Chrome omnibox on Android devices prior to build 154.0.8037.57. A web page crafted with malicious intent can reshape the browser’s address bar to display a different domain than the one actually loaded. This allows attackers to deceive users into believing they are visiting a trusted site. The weakness is categorized as CWE‑451, where sensitive browsing information is disclosed through an inappropriate UI modification.

Affected systems are Android installations of Google Chrome before Chrome 154.0.8037.57. Users running older Chrome builds on Android phones or tablets are susceptible. The issue does not affect other browsers or Chrome on non‑Android platforms.

The CVSS score of 5.4 places the vulnerability in the low severity range, and there is no EPSS metric available to indicate current exploitation likelihood. The vulnerability is not listed in CISA’s KEV catalog. Exploitability requires the attacker to host a malicious web page that the victim opens; no privilege escalation or code execution is achieved. The primary risk is phishing, with limited impact on configuration or system integrity.