Google Chrome versions before 148.0.7778.96 contain a weakness where the WebApp component does not enforce its security policy strictly. This flaw enables a malicious web page to forge user interface elements, misleading users into interacting with fake controls or entering sensitive data. The attack does not give code execution privileges, but it can lead to social engineering and data theft by convincing users that they are interacting with legitimate Chrome UI. The likely attack vector is a user visiting a crafted webpage, and it is inferred that user interaction is required for exploitation.

The affected product is Google Chrome. All desktop installations running any version prior to 148.0.7778.96 are vulnerable; the flaw was present in stable channel releases before that version. No other vendors or products are listed.

The CVSS score is 5.4, indicating a moderate risk level. The EPSS score is < 1% (approximately 0.06%), indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a user visiting a malicious webpage, and it is inferred that the attacker must lure a user into opening or interacting with a crafted HTML document in Chrome. The likelihood of exploitation is limited by the need for user interaction, but the impact could be significant if users provide sensitive information to the spoofed UI.