This vulnerability involves an inappropriate implementation of the Payments UI in Google Chrome versions before 149.0.7827.53. A remote attacker can exploit this by tricking a user into performing certain UI gestures on a maliciously crafted HTML page, resulting in UI spoofing. The CVSS 3.1 base score is 4.2, reflecting a medium severity with network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, limited confidentiality impact, no integrity impact, and low availability impact. No known exploits in the wild have been reported. The vendor advisory link is provided but does not explicitly confirm patch availability or remediation level.

The vulnerability allows UI spoofing which could mislead users interacting with the Payments interface in Chrome, potentially exposing limited confidential information or causing minor disruption. There is no indication of integrity compromise or significant availability impact. The attack requires user interaction and has high complexity, reducing the likelihood of widespread exploitation.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution when interacting with payment-related UI elements on untrusted websites and avoid performing unexpected UI gestures prompted by web content.