A flaw in the Google Lens component used by Google Chrome allows a remote attacker who has already taken control of the renderer process to craft a malicious HTML page that can visibly spoof the user interface. The inappropriate implementation enables the attacker to replace or mimic legitimate UI elements, potentially deceiving the user into interacting with a deceptive page. Because the vulnerability requires that the attacker first compromise the renderer process, the overall impact is limited to UI manipulation rather than direct code execution or data disclosure, which explains the low severity rating.

Google Chrome users running any version before 151.0.7922.72 are affected. This issue is present in the stable desktop channel and any environment that incorporates the vulnerable Google Lens implementation. Users who have not upgraded remain susceptible as long as a separate vulnerability or misconfiguration has allowed the attacker to seize the renderer process.

The CVSS score of 4.3 reflects the low impact and high effort required. The EPSS score indicates an exploitation probability of less than 1%, and the vulnerability is not listed in the CISA KEV catalog. Successful exploitation would primarily result in UI spoofing and user deception; it does not provide an attacker with direct execution privileges or data exfiltration capabilities. The risk is further mitigated by Chrome’s process isolation and sandboxing, which contain any potential damage to the renderer process if already compromised.