Google Chrome contains an input validation weakness in its Speech module that allows a remote attacker who has already gained control of the renderer process to craft a web page that mimics legitimate Chrome UI elements. This flaw, classified as CWE‑20, enables user interface spoofing, potentially misleading users into interacting with malicious content that appears to originate from the browser.

Google Chrome stable channel desktop browsers with versions earlier than 150.0.7871.47 are affected. All newer builds contain the fix and are not vulnerable.

The exploitation scenario requires the attacker to control the renderer process, implying delivery of malicious content or a prior compromise of the browser. The EPSS score is < 1%, the CVSS score of 4.3 signals low severity, and the flaw is not listed in the CISA KEV catalog; it was exploited via a malicious web page executed after compromising the renderer process.