A flaw in Google Chrome prevents sufficient policy enforcement in the browser UI, enabling a remote attacker who has already compromised the renderer process to serve a crafted HTML page that can overwrite the displayed address in the Omnibox. The effect is that users see a forged URL that does not match the actual site they are interacting with, which can be leveraged for phishing or social engineering. The vulnerability carries a Medium severity assigned by Chromium security, indicative of the potential for user deception but not of direct system compromise.

All machines running the stable channel of Google Chrome with a version earlier than 147.0.7727.55 are affected. The weakness does not depend on operating system, extensions, or user settings; any installation of Chrome that allows the renderer process to be hijacked can be used to deliver the malicious page.

The flaw has a Medium CVSS score and no EPSS data is available, suggesting no evidence of widespread exploitation yet. Because the attacker must first achieve renderer‑process compromise—typically via a separate vulnerability or malicious content delivery—an adversary would need to bypass one protective layer first. Once that is achieved, the Omnibox can be spoofed to mislead the user, but this does not grant direct payload execution or system access. The risk is therefore limited to user deception unless combined with other exploits.