In Google Chrome versions older than 149.0.7827.53, the TabGroups feature contains an inappropriate implementation. A remote attacker can send malicious network traffic that manipulates the browser's UI, resulting in altered or misleading tab group displays. The flaw does not provide code execution, data exfiltration, or other privileges; it only affects visual rendering of tab groups.

Google Chrome stable channel desktop clients running any build before 149.0.7827.53 are affected. No additional channels, platforms, or version ranges are specified in the CVE description.

The vulnerability has a CVSS score of 5.4, an EPSS score of less than 1 %, and Chromium classifies it as Low. It is not in the CISA KEV catalog. The likely attack vector is through inbound network traffic that carries crafted content directed at the Chrome TabGroups UI. Though the exploit can only produce UI deception, it could aid phishing or social engineering if executed with coordination. Current evidence suggests the risk is limited and exploitation unlikely without targeted content.