An inappropriate implementation in the Isolated Web Apps feature of Google Chrome allows a remote attacker to serve a crafted HTML page that deceives the victim into interacting with a false user interface. This flaw does not provide direct code execution but can lead to phishing or tricking the user into performing unintended actions. The severity is reported as Low by Chromium.

Google Chrome versions prior to 150.0.7871.47 are vulnerable. Users of any such version are at risk if they visit malicious sites that host the crafted page.

No EPSS score is available and the vulnerability is not listed in CISA's KEV catalog. The attack requires the attacker to host a malicious page and rely on a social‑engineering component to lure the victim. The low severity rating and lack of exploitation evidence suggest a moderate risk, but the potential for deceptive UI interactions warrants timely remediation.