The vulnerability is a lack of proper validation for untrusted input in the Dialog component of Google Chrome. An attacker who has already compromised the renderer process can serve a crafted HTML page that causes the browser to display fake interface elements, potentially tricking a user into interacting with malicious content. The flaw allows only UI spoofing; it does not provide direct code execution or data exfiltration capabilities beyond the deceptive user experience. The root cause is an input validation defect identified as CWE‑20 and CWE‑79.

Google Chrome installation (any version prior to 148.0.7778.96). The issue exists in the stable channel of the browser and is fixed in the release 148.0.7778.96 and newer.

The CVSS score of 5.4 indicates a Low severity assessment, reflecting the limited nature of the impact. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker already have control over the renderer process, which is a significant prerequisite. Because of the limited scope and lack of publicly known exploits, the risk is currently low, yet the UI deception can still facilitate phishing or other social engineering attacks.