The flaw in Chrome’s Paint component allows a malicious webpage to cause the browser to render interface elements that appear legitimate but are actually deceptive, enabling phishing or social‑engineering attacks. The implementation is inappropriate, resulting in UI spoofing that can mislead users into providing sensitive information without executing code.

Vulnerable users are those running the Chrome desktop stable channel with a version earlier than 150.0.7871.47. Only the Paint feature is impacted; other browsers or Chrome components are unaffected.

Chromium rates the issue as medium severity and no EPSS score is available. It has not been recorded in the CISA KEV catalog. The likely attack vector is remote via a maliciously crafted HTML page presented to the user, who must load the content for the spoofed UI to appear.