A flaw in the SSL input validation in Google Chrome before version 148.0.7778.96 allows a remote attacker, once the renderer process is compromised, to craft HTML that can deceive users into accepting forged content. The weakness originates from insufficient checks on untrusted input delivered over SSL, leading to a user interface spoofing attack. Because the vulnerability can mislead users into interacting with malicious content, it presents a significant threat to user trust and data integrity within the browser.

The affected product is Google Chrome. All releases of Chrome prior to 148.0.7778.96 are vulnerable. Users running any of those versions should consider updating promptly.

The CVSS score is 4.2; the official severity is listed as Low. EPSS data is unavailable and the vulnerability is not in the CISA KEV catalog. The exploitation path requires a remote attacker to first compromise the renderer process, which limits immediate risk but remains a concern for environments where such compromise is feasible. Because no public exploits are known, the likelihood of attack is considered low; however, upgrading mitigates all known risk.