An inappropriate implementation in the WebUI of Google Chrome prior to version 149.0.7827.53 enables a remote attacker to craft a domain name that is displayed incorrectly in the user interface. The resulting domain spoofing can mislead users into believing they are interacting with a legitimate site, creating a phishing vector. The vulnerability is rated low by Chromium security severity, indicating limited impact if exploited only to confuse users, but the potential to facilitate social‑engineering attacks remains significant.

All desktop users running Google Chrome versions earlier than 149.0.7827.53 are affected, regardless of operating system. The issue is tied to the stable channel releases, as documented in Google’s release notes and Chromium issue tracker.

The CVSS score is not publicly documented, and the EPSS score is unavailable, but the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only the ability to craft a domain name that the WebUI will display; no additional privileges or code execution are needed. The likely attack vector is a remote phishing scenario where an attacker presents a forged domain to lure a user within Chrome.