This vulnerability is a policy bypass in the Blink rendering engine of Google Chrome. A remote attacker can deliver a specially crafted HTML page that tricks a user into interacting with a counterfeit interface, thereby enabling UI spoofing. The flaw stems from improper enforcement of UI policy and is classified as CWE‑1021 and CWE‑639. It does not grant arbitrary code execution or directly compromise system confidentiality or integrity, but it undermines the user’s trust in the browser’s interface, resulting in a medium‑risk phishing vector.

Google Chrome users running any version prior to 147.0.7727.55 are vulnerable. The issue applies to installations on Windows, macOS, and Linux, as indicated by the associated CPE strings. Any user who visits a malicious web page containing a crafted HTML payload can be affected.

The CVSS score of 4.3 indicates a medium severity. The EPSS score is under 1%, implying a low likelihood of widespread exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a remote attacker to supply the crafted HTML page; the attack vector is inferred to be web‑based content. No public exploit code is mentioned in the CVE data, and elevated privileges are not required.