An inappropriate implementation in the Payments component of Google Chrome allows a remote attacker to deliver a crafted HTML page that can spoof the user interface when the user interacts with payment prompts. The spoofed UI can potentially confuse users into submitting sensitive payment information or granting permissions, thereby enabling economic loss or unauthorized transactions. The vulnerability is classified as low severity by Chromium's internal scoring but still poses a real threat if exploited.

Cr/ Google Chrome desktop browsers with versions earlier than 149.0.7827.53 are vulnerable. Users on the stable channel who have not applied this update are at risk.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no known high‑volume exploitation. The likely attack vector is a user visiting a malicious web page that triggers the UI spoofing through the Payments interface. While the risk is moderate due to the need for user interaction, the potential impact on user trust and financial integrity warrants timely remediation.