The vulnerability is an incorrect security UI in Google Chrome’s Picture‑in‑Picture (PIP) mode. A remote attacker can craft an HTML page that triggers PIP and displays UI elements that appear legitimate but mimic system notifications or prompts, allowing the user to be deceived into interacting with malicious content. This constitutes user interface spoofing (CWE‑451) and could lead to social‑engineering attacks.

Google Chrome browsers below version 146.0.7680.71 on any supported operating system—Windows, macOS, and Linux—are affected. The issue is present in the stable channel build and impacts all users who enable PIP on webpages.

The CVSS v3.1 score of 4.3 reflects a low severity. The EPSS score is less than 1 %, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to get the victim to visit a malicious webpage with PIP enabled; the exploit is remote and requires no local privilege. Given the low probability and user‑centric impact, the risk is considered low, but mitigation through updating remains recommended.