Inappropriate implementation in the Updater component of Google Chrome on Windows prior to 151.0.7922.72 allows a local attacker to perform UI spoofing through a malicious file. This bug can trick a user into interacting with content that appears legitimate, potentially leading to unintended actions or data exposure. The vulnerability was classified as low severity by Chromium’s security team.

Affected systems are those running Google Chrome on Windows that have not yet updated to version 151.0.7922.72 or later. The issue is confined to the updater process and does not impact other Chrome components. Users on any Windows installation that has the vulnerable Chrome build are at risk.

The CVSS score of 4 reflects a low overall risk, while the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. An attacker must have local access to place a malicious file that the Updater will load unverified, thereby enabling UI spoofing. No network-based exploitation is described.