The vulnerability resides in Chrome’s WebAppInstalls component, where an insecure implementation allows a malicious HTML page to override or duplicate user interface elements. This UI spoofing could mislead a user into interacting with deceptive controls or entering sensitive information, thereby compromising confidentiality and trust. The weakness is identified as CWE‑1021, improper authorization, along with CWE‑451, insufficient notification of potential misuse.

Google Chrome versions earlier than 151.0.7922.72 on any operating system are affected. All builds that include the WebAppInstalls feature are vulnerable until the specified update is installed.

The CVSS score of 6.5 indicates medium severity, and the EPSS score of less than 1 % shows that exploitation is currently unlikely. This vulnerability is not listed in CISA’s KEV catalog. The likely attack path involves serving a malicious web page that the user visits; the attacker then delivers crafted HTML to subvert the browser’s UI. Although no remote code execution is involved, the attack can lead to credential theft and loss of user trust.