An insufficient policy enforcement bug in Google Chrome’s browser UI allows an attacker who has already compromised the renderer process to forge the contents of the omnibox, the URL bar. By loading a specially crafted web page, the attacker can cause Chrome to display a deceptive URL that does not match the actual page being viewed. This manipulation can trick users into believing they are interacting with a trusted site, potentially leading to phishing and credential theft. The vulnerability is classified as medium severity.

Versions of Google Chrome prior to 147.0.7727.55 are affected on all supported operating systems, including Windows, macOS, and Linux. The problem is tied to the renderer component, which runs on any platform that hosts the Chrome browser. Users on older releases running the default stable channel are at risk if they visit malicious sites that exploit the renderer.

The CVSS score of 4.3 indicates a moderate impact, while an EPSS of less than 1% suggests that exploitation attempts are expected to be rare. The vulnerability is not listed in the CISA KEV catalog, implying it has not yet been actively used in the wild. Exploitation requires a remote attack that first gains control of a renderer process, which typically means delivering a malicious website or taking advantage of another local compromise. Given these prerequisites, the likelihood of successful exploitation is low but non‑zero, and administrators should prioritize patching when possible.