An incorrect security UI in Chrome’s Tab Strip allows a remote attacker to craft a malicious HTML page that displays a deceptive domain name, enabling users to believe they are on a trusted site. Based on the description, it is inferred that a user may provide sensitive information to the attacker, potentially leading to credential theft or other social‑engineering attacks by compromising user confidence in the address bar.

Google Chrome versions prior to 149.0.7827.53 are affected. Users of the stable channel before this patch must upgrade to mitigate the flaw.

The vulnerability is low severity, with a CVSS score of 6.5, an EPSS score of < 1%, and it is not listed in the CISA KEV catalog. The attack requires a remote attacker to host a crafted HTML page and have a user visit it; the likely attack vector is a user browsing to a malicious site that presents a spoofed domain in the UI. Once the deception is accepted, the user may unknowingly provide sensitive information to the attacker.