An improper UI implementation in Google Chrome versions prior to 150.0.7871.47 allows a remote attacker to deliver a crafted HTML page that, when a user performs certain gestures, displays a spoofed interface mimicking a legitimate page. The flaw is identified as CWE-451 and can result in visual deception, potentially facilitating social engineering or phishing attempts. No evidence in the CVE data indicates code execution or data exfiltration.

Google Chrome browsers released before version 150.0.7871.47 are affected. The problem is confined to the browser’s UI layer and does not directly impact other system components or user accounts.

The vulnerability can be exploited remotely by sending a malicious web page to a user and encouraging the required UI gestures. The CVSS score of 4.2 reflects medium severity, and the EPSS score of less than 1 % indicates a low likelihood of exploitation. Google has not listed this issue in the CISA KEV catalog. The likely attack vector is a web-based interaction with a crafted page, and the primary risk is phishing or user deception through UI spoofing.