The vulnerability is caused by incorrect implementation of the security UI in the file input control in Google Chrome. A malicious web page can trigger a UI‑spoofing condition that causes the browser to display a file chooser dialog that does not reflect the true source or intent of the request. This flaw falls under the category of UI spoofing weaknesses and is mapped to CWE‑451 (Failure to Provide an Adequate User Interface) and CWE‑1021. An attacker may thereby trick a user into selecting or uploading a file that the user would not normally choose, aiding phishing or social‑engineering attacks. The flaw does not provide direct remote code execution or data exfiltration, and is classified as low severity.

All desktop instances of Google Chrome using a version earlier than 149.0.7827.53 are affected. The vulnerability applies to Chrome 149.0.0 through 149.0.7827.52. Versions 149.0.7827.53 and above have the fix applied.

The EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not a widely exploited flaw. The CVSS score of 4.3 classifies the risk as low severity. Exploitation requires a crafted HTML page that persuades a user to interact with a file input control, making it a user‑interactive attack. The overall risk is considered low, and the primary mitigation is to ensure the browser is updated to a version where the issue is resolved.