This vulnerability involves an incorrect security UI in the Tab Hover Cards feature of Google Chrome before version 149.0.7827.53. The flaw permits remote attackers to spoof domain names via specially crafted domains, misleading users about the true origin of a webpage. The issue is categorized under CWE-451 (Incorrect Expression of Security Controls). The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No known exploits are reported in the wild. The vendor advisory link is provided but does not explicitly confirm patch availability or remediation status.

The vulnerability allows attackers to spoof domain names in the Tab Hover Cards UI, potentially misleading users about the legitimacy of websites they visit. This can lead to phishing or social engineering attacks that compromise user trust and data integrity. There is no direct impact on confidentiality or availability according to the CVSS metrics.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users and administrators should monitor official Google Chrome release notes for updates addressing this issue. Until a fix is confirmed, exercise caution with suspicious domain names shown in Tab Hover Cards.