A flaw in Chrome’s Tab Hover Card UI allows a maliciously crafted domain name to appear legitimate when a user hovers over a link, enabling domain spoofing. The description explicitly states that a remote attacker can use a crafted domain name to deceive users. The potential of this flaw to serve as a phishing vector is inferred from the mention of domain spoofing and the common use of hover cards to convey trust cues, although the description does not directly describe phishing scenarios. The vulnerability is stated to be remote, and no local privileges or prior access are required, so remote‑only exploitation is inferred because the description does not mention local conditions.

Google Chrome versions prior to 149.0.7827.53 on Windows, macOS, and Linux are affected. All later releases contain the fix.

The CVSS score is 6.5 and the EPSS score is < 1%, indicating a medium overall severity and a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation is remote‑only; an attacker only needs to craft a domain that will appear in the hover card and provoke the user to hover over a link or button. No local privileges or prior access are required.