An improper implementation in Google Chrome’s Paint component allowed a remote attacker to deliver a crafted HTML page that could modify or spoof the browser’s user interface. The attacker can introduce deceptive visual elements, potentially leading users to believe legitimate content is present when it is not, thereby facilitating phishing or social‑engineering attacks. The vulnerability directly compromises the integrity of the displayed interface, but does not provide arbitrary code execution or elevated privileges.

Google Chrome browsers running build versions earlier than 150.0.7871.47 are affected. The issue applies to the stable channel of Google Chrome on desktop platforms (inferred from the release notes).

Chromium rates the severity as Medium, and no EPSS score is currently available. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only a crafted web page served to the victim’s browser, making the attack surface relatively low, though the deception capability is significant. The threat remains a moderate risk until a patch is applied.