An attacker can supply specially crafted untrusted input to Google Chrome before version 149.0.7827.103, enabling them to forge user interface elements and trick users into interacting with malicious controls. This flaw does not allow arbitrary code execution but can be leveraged for phishing or social engineering attacks that compromise user trust and data. The underlying weakness is an improper input validation problem (CWE‑20) and a cross‑site scripting flaw (CWE‑79).

The vulnerability exists in all pre‑149.0.7827.103 releases of Google Chrome across all platforms. Users running older Chrome versions are susceptible; upgrading to the latest stable channel mitigates the issue.

Chromium labels the severity of this flaw as high, reflected by a CVSS score of 5.4, and it is not currently listed in the CISA KEV catalog. The EPSS score is < 1 %, indicating a very low risk of exploitation at the time of this analysis. The attack vector requires an attacker to host a malicious HTML page or inject crafted content, and a user must interact with that page. Because the flaw allows UI manipulation but not code execution, exploitation may be limited to scenarios where user interaction can be forced. Nonetheless, the high severity coupled with the ability to deceive users warrants prompt remediation.