An incorrect security UI implementation in Google Chrome's WebUI before version 149.0.7827.53 permits remote attackers to conduct domain spoofing attacks by using crafted domain names. This vulnerability is tracked as CVE-2026-11225 and is associated with CWE-451 (Incorrect Security UI). The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The vendor advisory linked does not explicitly state patch availability or remediation level, and no known exploits have been reported.

The vulnerability allows remote attackers to spoof domain names in the browser's UI, potentially misleading users about the authenticity of websites. This can lead to integrity issues such as phishing or social engineering attacks. There is no impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until official fixes are confirmed, users should exercise caution when interacting with suspicious domains and ensure their browsers are updated to the latest available version.