This vulnerability in Google Chrome's File Input component allows remote attackers to conduct UI spoofing by exploiting an inappropriate security UI implementation. The issue affects versions prior to 149.0.7827.53. Exploitation requires user interaction (UI gestures) and can be triggered via a crafted HTML page. The CVSS score is 4.3 (medium severity), reflecting low impact on confidentiality and availability but some impact on integrity. There is no evidence of known exploits in the wild. The vendor has published a stable channel update announcement but has not explicitly stated the remediation level or patch availability in the provided advisory link.

The vulnerability enables UI spoofing which may mislead users into believing they are interacting with legitimate UI elements when they are not. This can potentially facilitate social engineering attacks but does not directly compromise data confidentiality or system availability. The integrity of the user interface is affected, which could lead to user deception.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users and administrators should monitor official Google Chrome release notes and apply updates promptly once a fix is confirmed available.