This vulnerability involves an incorrect security UI rendering in the Omnibox of Google Chrome on Android before version 147.0.7727.55. A remote attacker can craft an HTML page that spoofs the URL bar contents, potentially misleading users about the site they are visiting. The issue is classified under CWE-451 (Incorrect Expression of User Interface). The CVSS score is 4.3 (medium severity), reflecting low impact on confidentiality, limited integrity impact, and no availability impact. No official remediation level or patch confirmation is provided in the vendor advisory.

The vulnerability allows remote attackers to spoof the URL displayed in the Omnibox, which could lead to user confusion or phishing attempts by making malicious sites appear legitimate. However, the impact is limited to integrity (misleading UI) with no direct confidentiality or availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html for current remediation guidance. Users should update to Chrome version 147.0.7727.55 or later once available to ensure the vulnerability is addressed. Until then, exercise caution when interacting with suspicious web pages.