Insufficient policy enforcement in Chrome’s Frames component allowed a remote attacker to craft a web page that could deceive users by displaying malicious content within frames. The flaw opens a channel for UI spoofing attacks, enabling attackers to mimic legitimate interfaces and potentially influence user interactions or harvest credentials. The weakness is identified as CWE‑451: Failure to Compensate for a Lack of Security Requiring Protection.

All installations of Google Chrome before version 145.0.7632.45 across supported operating systems – Windows, macOS, Linux – are affected. No specific operating‑system variations are noted; any Chrome build prior to the specified patch is susceptible.

The vulnerability carries a CVSS score of 6.5, indicating medium severity. Its EPSS score is less than 1 %, suggesting very low current exploitation probability, and it is not listed in the CISA KEV catalog. Attackers would need to deliver a deliberately crafted HTML page to a victim’s browser, either by hosting a malicious site or through compromised content, to exploit the flaw. No advanced persistence or privilege escalation is required beyond the UI deception objective.