Insufficient validation of untrusted input in PointerLock in Google Chrome weakens the boundary between web content and system UI. An attacker who has already compromised the renderer process can supply crafted input that causes Chrome to display forged user interface elements. Although this flaw does not provide code execution or data exfiltration, it enables phishing or social‑engineering attacks by tricking users into interacting with deceptive dialog boxes or prompts. Based on the description, it is inferred that the attacker must first compromise the renderer process, possibly via a separate vulnerability, before the UI spoofing can be triggered.

Google Chrome versions earlier than 149.0.7827.53 are affected. The flaw applies to all platforms that run the desktop client and include the PointerLock API prior to this release.

The CVSS score of 4.3 indicates low severity, and the EPSS score of < 1% suggests that public exploitation activity is very unlikely. The flaw is not listed in CISA’s KEV catalog. Exfiltration or data loss is not a concern, but phishing is possible. The exploitation path requires the attacker to first compromise the renderer process, which is a higher barrier but still possible via other vulnerabilities. Thus, the overall risk is low but present in environments where the renderer process can be compromised.