Inappropriate handling of settings allows a remote attacker to cause the browser to display forged web page elements, effectively spoofing the user interface. The vulnerability is classified as a UI spoofing flaw and can mislead users into interacting with content or links that appear legitimate but are actually malicious. The related weakness is listed as CWE‑451, indicating insecure information exposure arising from improper settings implementation.

Google Chrome, all releases prior to version 151.0.7922.72 are potentially vulnerable. The issue was fixed in the 151.0.7922.72 build released in July 2026.

The CVSS score of 4.3 indicates moderate severity, with the EPSS score below 1% suggesting a low likelihood of exploitation. The vulnerability is not part of CISA’s Known Exploited Vulnerabilities catalog. Attackers would need to send crafted network traffic to a user’s browser, leveraging the Settings component to alter the UI. Since the flaw is not privilege‑escalating or enabling arbitrary code execution, the risk remains bounded to user deception and potential credential theft if users are tricked into providing sensitive information.