Insufficient policy enforcement in the Google Chrome extension framework before version 150.0.7871.47 allows an attacker who convinces a user to install a malicious extension to perform UI spoofing. The attacker can craft a malicious Chrome Extension that, once installed, deceives users into interacting with misleading or deceptive UI. The weakness is identified as CWE-451. No exploitation of system resources or data beyond UI deception is described.

The vulnerability affects users of Google Chrome on desktop operating systems running versions older than 150.0. The CVE text does not explicitly name particular OS platforms; this absence of explicit mention is an inferred assumption that desktop platforms are impacted, while Android, Chrome OS, or other non‑desktop environments are not specifically listed and therefore are presumed not to be affected.

The CVSS score of 3.1 indicates low severity, and the EPSS score of less than 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. The attack vector requires a user to install a malicious extension, meaning that social engineering is needed. Once installed, the extension can perform UI spoofing to trick users into interacting with deceptive interfaces, but it cannot directly access system resources beyond the Chrome UI. Thus the risk is primarily to end‑users prompted to install extensions through non‑trusted channels.