An insufficient validation flaw in the Network component of Google Chrome enabled a remote attacker who had already compromised the renderer process to deliver a crafted HTML page that spoofs the user interface. The weakness, characterized as CWE-20, allows UI spoofing that may mislead users into believing they are interacting with a legitimate page. The Chromium security team rates the issue as Medium severity.

The issue impacts all Google Chrome installations older than version 148.0.7778.96. Any browser running a pre‑148.0.7778.96 build is vulnerable to the input validation weakness affecting the Network module.

The vulnerability carries a CVSS score of 4.2, indicating a Medium severity rating. EPSS data is not available, and the flaw is not listed in CISA’s KEV catalog, suggesting that widespread exploitation has not been observed yet. Attackers require prior compromise of the renderer process to craft the malicious HTML, meaning the exploit path is somewhat restricted but still poses a risk of UI deception within compromised sessions.