This vulnerability originates from an unsafe implementation in Chromium’s Paint component. A malicious web page can instruct the browser to render a fabricated user interface element that looks legitimate, tricking the user into interacting with it. The flaw falls under CWE-451, describing an inappropriate implementation that allows an attacker to spoof UI objects. Consequently, a user could be deceived into opening or submitting information, potentially leading to phishing or deceptive transactions.

All desktop releases of Google Chrome before version 150.0.7871.47, regardless of operating system, contain the Paint component that is affected. System administrators should examine any Chrome instances still running a Version earlier than 150.0.7871.47 for potential exposure.

The CVSS score of 6.5 indicates a moderate severity. An EPSS score of less than 1% shows that, at the moment, exploitation is unlikely. The vulnerability is not in the CISA KEV catalog, and there are no known public exploits in the CVE record. Attack requires a specially crafted HTML page delivered to an end‑user; only a user who views that page and interacts with the spoofed UI could be harmed. No remote code execution or system compromise is possible. Organizations should treat it as a moderate risk until a patch is available.