Inappropriate implementation of the Paint component in Google Chrome versions prior to 150.0.7871.47 allows a remote attacker to serve a crafted HTML page that can modify or spoof the browser’s user interface. This is a CWE‑451 flaw, representing improper validation that does not provide code execution or elevated privileges; it only compromises the integrity of the visual presentation. An attacker could display false prompts or redirect clicks, potentially deceiving users into interacting with malicious content or divulging sensitive information, though the description does not state a proven social‑engineering exploitation, so this consequence is inferred from the capability offered by the spoofed UI.

Google Chrome browsers are affected. All builds before 150.0.7871.47 may be vulnerable.

The flaw is rated Medium with a CVSS score of 4.3. EPSS is less than 1%, indicating a very low but nonzero likelihood of exploitation, and the vulnerability is a malicious HTML page is the required method, so an attacker only needs to host or embed the opportunity for deception remains notable, but the overall risk is moderate in the absence of a broader exploitation vector.