An incorrect security UI element in Chrome’s Blink rendering engine allows an attacker to create a crafted webpage that mimics legitimate browser dialogs or security prompts. By presenting this forged interface to a user, the attacker can lure the victim into providing sensitive information or performing actions that they would normally avoid. This deception undermines the user’s trust in Chrome’s native UI, potentially leading to credential compromise or unauthorized actions.

Google Chrome versions prior to 147.0.7727.55 are affected. The vulnerability is present in Blink and therefore impacts all platforms that ship this browser revision within the stable release channel.

The CVSS score is labeled as medium, indicating a moderate overall risk. EPSS score is not available, and the vulnerability is not included in the CISA KEV catalog. Exploitation requires a victim to visit or load a maliciously crafted webpage; the attack vector is therefore remote, relying on client‑side interaction via the browser. No user privilege escalation or code execution is granted, but the social engineering impact can be significant for end users.