A flaw in Google Chrome’s Global Media Controls enables a remote attacker to construct a malicious HTML page that can visually mimic legitimate UI elements. The incorrect implementation allows the attacker to spoof the user interface without executing arbitrary code. The potential consequence is a phishing‑style trick where a user may believe they are interacting with a trustworthy control and inadvertently reveal information or trigger unintended actions.

Google Chrome browsers prior to version 151.0.7922.72 are affected. The vulnerability disappears in the 151.0.7922.72 release and all later builds.

The CVSS score of 4.3 indicates low severity, and the EPSS score of less than 1% shows a very low probability that exploitation is occurring today. The vulnerability is not yet listed in CISA’s KEV catalog. The likely attack vector is a remote attacker hosting a crafted HTML page that a victim visits; upon loading the page, the spoofed controls can deceive the user. Because no code execution or privilege escalation is possible, the risk is confined to user deception but can still facilitate phishing or unauthorized interactions.