An inappropriate implementation in the Chrome WebUI before version 149.0.7827.53 allows a remote attacker to craft a domain name that the browser displays incorrectly. The spoofed domain can mislead users into believing they are interacting with a legitimate site, creating a phishing vector. The flaw does not enable code execution or privilege escalation; its effect is limited to deceiving users about the site they are visiting.

All desktop users running Google Chrome versions earlier than 149.0.7827.53, regardless of operating system. The affected releases are part of the stable channel as noted in Google’s release announcements.

The CVSS score is 6.5 and the EPSS score is below 1%, indicating low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only the ability to present a forged domain to the browser; no additional privileges or code execution are necessary. The likely attack vector is a remote phishing scenario where an attacker delivers a crafted URL to a user within Chrome.