A crafted Chrome extension can present a deceptive user interface that mimics legitimate Chrome dialogs, allowing an attacker to trick the user into entering sensitive data or taking actions that compromise trust. This UI spoofing flaw circumvents normal security cues and can lead to credential theft or other privacy violations. The vulnerability aligns with CWE-1021 for incorrect UI representation and with CWE-451 for untrusted input that does not rely on authentication.

Google Chrome versions older than 151.0.7922.72 on Windows, macOS and Linux are affected. All users of the stable channel running a pre‑151.0.7922.72 build are vulnerable.

The CVSS score of 4.3 indicates medium severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, and it requires the user to accept a malicious extension, meaning social engineering is a prerequisite for success. Exploitation would produce UI spoofing, but would not allow direct code execution or broader system compromise.