This vulnerability concerns an incorrect security UI implementation in the Messages component of Google Chrome for Android before version 149.0.7827.53. The issue enables remote attackers to conduct UI spoofing attacks by leveraging a specially crafted HTML page, potentially misleading users about the authenticity or security state of the interface. The vendor advisory linked does not explicitly confirm the availability of a patch or remediation status. The vulnerability is rated medium severity by Chromium security standards.

The impact of this vulnerability is limited to UI spoofing, which could deceive users into believing they are interacting with a legitimate interface when they are not. This may facilitate social engineering attacks but does not directly indicate code execution or data compromise. No known exploits in the wild have been reported, suggesting limited active exploitation at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed and applied, users should exercise caution when interacting with untrusted HTML content in Chrome Messages on Android. No vendor advisory states that no action is required or that the issue is already mitigated.