This vulnerability involves an inappropriate implementation in the Autofill component of Google Chrome on Android, which enables remote attackers to conduct UI spoofing attacks by crafting malicious HTML pages. The flaw is identified as CWE-451 (Incorrect Expression of User Interface in Web Page). The CVSS vector indicates the attack requires no privileges and user interaction, with no impact on confidentiality or availability but with low impact on integrity. The vulnerability affects Chrome versions prior to 150.0.7871.47 on Android. The vendor advisory link is provided but does not explicitly confirm patch status or remediation level.

The vulnerability allows remote attackers to perform UI spoofing, potentially misleading users by displaying deceptive user interface elements. This can lead to user confusion or tricking users into unintended actions. There is no impact on confidentiality or availability, and the integrity impact is low. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Users should update to Chrome version 150.0.7871.47 or later once available to mitigate this issue. Until then, be cautious of untrusted web pages that might attempt UI spoofing via Autofill.