A flaw in the SSL input validation in Google Chrome before version 148.0.7778.96 allows a remote attacker, once the renderer process is compromised, to craft HTML that can deceive users into accepting forged content. The weakness originates from insufficient checks on untrusted input delivered over SSL (CWE‑20) and also represents an improper handling of SSL data (CWE‑807). Because the vulnerability can mislead users into interacting with malicious content, it presents a significant threat to user trust and data integrity within the browser.

The affected product is Google Chrome. All releases of Chrome prior to 148.0.7778.96 are vulnerable. Users running any of those versions should consider updating promptly.

The CVSS score is 4.2; the official severity is listed as Low. The EPSS score indicates a very low exploitation probability (<1%) and the vulnerability is not in the CISA KEV catalog. The exploitation path requires a remote attacker to first compromise the renderer process, which limits immediate risk but remains a concern for environments where such compromise is feasible. Because no public exploits are known, the likelihood of attack is considered low; however, upgrading mitigates all known risk.