An insufficient validation of the PopupBlocker module allowed a remote attacker who has already compromised the browser’s renderer process to craft an HTML page that could spoof the browser’s user interface. The flaw permits presentation of UI elements that appear legitimate. Based on the nature of UI spoofing, it is inferred that this could be used for phishing attacks, but this is not specifically stated in the CVE description. The weakness is a classic input‑validation flaw identified as CWE‑20, and the Chromium release notes classify its severity as low.

Google Chrome browsers running any version earlier than 150.0.7871.47 are vulnerable. The issue applies to all platforms where the vulnerable renderer component is present, regardless of operating system or device type.

The flaw can be exploited only after the attacker has already compromised the browser’s renderer process, which represents a low likelihood (EPSS < 1%) and the low CVSS score of 4.3 indicate a low impact under normal circumstances is not listed in CISA’s KEV catalog and no public exploitation has been reported, the current risk to end users is limited, but threats remain if an attacker gains renderer‑level control.