A policy bypass in Chrome’s Blink engine allows an attacker to deliver a malicious HTML page that can visually mimic legitimate pages, enabling phishing or social engineering attacks. The flaw does not grant code execution but can deceive users into trusting spoofed interfaces. The vulnerability is catalogued as Medium severity with a CVSS score of 5.4, reflecting surface-level impact focused on UI manipulation rather than system compromise.

The affected product is Google Chrome for desktop environments. Versions prior to 147.0.7727.55 are vulnerable to the Blink policy bypass that permits UI spoofing. Updated releases of Chrome include mitigations that remove this flaw.

Capitalizing on this defect requires a crafted HTML page served remotely, meaning the attacker must entice a user to load the page (typical phishing scenario). Because the exploitation surface does not involve privilege escalation or direct code execution, the EPSS score is below 1%, indicating low expected exploitation rates. The CVSS score signals medium risk, and the vulnerability is not listed in CISA’s KEV catalog, so there is no confirmed widespread exploitation. Nonetheless, the attack vector presents a credible risk for deceptive UI attacks that could compromise user data or credentials if a user is convinced by the spoofed interface.