A flaw in Google Chrome’s Windows UI implementation allows a remote attacker who has already compromised the renderer process to craft an HTML page that causes the browser to display misleading or malicious user interface elements. The vulnerability can be exploited by delivering specially designed HTML, leading the user to be deceived by spoofed dialog boxes or prompts. The vulnerability is classified as Critical by the Chromium security team.

Google Chrome running on Windows, specifically all releases prior to version 148.0.7778.179. The issue affects the renderer process utilized by the browser’s UI component.

The CVSS score of 4.2 indicates a moderate severity, and the vulnerability is not currently listed in the CISA KEV catalog. The EPSS score of < 1% indicates a very low but nonzero probability of exploitation, though no public exploitation has been reported. Exploitation requires the attacker to have already escalated or compromised the renderer process, typically through another vulnerability or local privilege compromise. When present, a malicious crafted HTML page could trick users into interacting with forged dialogs, facilitating phishing or credential theft. The security impact lies in the potential for deceptive UI manipulation that can lead to further compromise.