The vulnerability arises from an incorrect security UI implementation in Chrome extensions, enabling a malicious extension that a user has installed to spoof the browser’s interface. This flaw, classified as CWE-451, can trick users into misinterpreting prompts or authority indications, potentially facilitating phishing or other deceptive behaviors. The primary impact is social engineering via UI spoofing, not a direct code execution or data exposure.

The affected product is Google Chrome. Versions before 151.0.7922.72 contain the flaw; the fix is included in that release and later updates.

The CVSS score is 4.3, indicating a low severity level, and the EPSS score is under 1%, pointing to a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to persuade a user to install a malicious extension—likely through social engineering or exploiting a malicious or compromised extension in the Chrome Web Store. Because the exploit requires user action, the overall risk to organizations is limited if users follow best practices for extension installation.