Insufficient policy enforcement in the Chrome browser UI allows an attacker who has compromised the renderer process to craft an HTML page that displays fake UI elements, creating the illusion of legitimate content. The weakness, identified as UI spoofing, can mislead users into interacting with malicious input or revealing sensitive information. This attack primarily affects the integrity of the browsing experience and can undermine user trust without compromising system confidentiality.

Chrome versions released before 147.0.7727.55 on all supported operating systems, including Windows, macOS, and Linux. Users of these versions are at risk regardless of platform.

The CVSS score of 4.3 classifies the vulnerability as Medium, yet the EPSS score of less than 1% implies a low probability of exploitation. It is not currently listed in the CISA KEV catalog. Exploitation requires the attacker to compromise or control the renderer process, which typically occurs when the user visits a malicious or compromised webpage or installs a malicious extension. Once the renderer is compromised, the attacker can perform UI spoofing without additional privileges or network access.