The vulnerability arises from an inappropriate implementation in the Media component of Google Chrome that permits a remote attacker to craft an HTML page that performs UI spoofing. This flaw can mislead users into believing they are interacting with a legitimate interface when the page interface has been altered by the attacker. The official Chromium severity is low, indicating no confirmed code execution or direct data theft, but the deception could facilitate credential phishing or other social‑engineering attacks.

The issue affects all Google Chrome editions that run a version prior to 148.0.7778.96. Users of earlier stable channel releases are vulnerable; no other products or vendors are listed as affected.

A CVSS score of 5.4 indicates moderate risk and the EPSS score of <1% indicates a very low exploitation probability, while the vulnerability is not listed in CISA’s KEV catalog, indicating that active exploitation has not been observed. The likely attack vector is a crafted HTML page served to the user, requiring the user to visit the page. Because the flaw only enables UI spoofing and does not grant code execution, the risk is moderate but could be amplified if combined with phishing techniques.