The vulnerability is an incorrect security interface in the Picture-in-Picture feature of Google Chrome that lets a remote attacker use a crafted web page to display UI elements that appear legitimate. This graphic spoofing can deceive users into interacting with deceptive content or trusting a page that it is not. The impact is confined to the user interface and does not grant code execution or direct access to system data.

All operating systems supported by Google Chrome are affected, as the flaw exists in the browser itself. The security issue applies to Chrome versions prior to 146.0.7680.71 and is present on macOS, Linux, and Windows platforms. Updating to the specified version or newer removes the incorrect UI behavior.

With a CVSS score of 4.3 and an EPSS of less than 1%, the risk is moderate and exploitation unlikely to be widespread. The flaw is not listed in the CISA KEV catalog, indicating no known active exploitation. The attack vector is inferred to be a normal web browsing session where a malicious site serves a specially crafted page that forces the browser to open Picture-in-Picture with a counterfeit security UI. Successful exploitation requires the target user to interact with the overlay, leading to possible user confusion or phishing.