This vulnerability concerns an inappropriate implementation in the Payments component of Google Chrome versions before 149.0.7827.53. It enables a remote attacker to conduct UI spoofing attacks by using a specially crafted HTML page. UI spoofing can mislead users by displaying deceptive interface elements, potentially causing them to take unintended actions. The issue is classified with low severity by the Chromium security team. No CVSS score or detailed technical exploit information is provided. The vendor advisory linked does not explicitly confirm patch availability or remediation steps.

The impact is limited to UI spoofing, which can trick users into believing they are interacting with legitimate browser or payment UI elements. This could potentially lead to user confusion or social engineering attacks but does not indicate direct code execution or data compromise. There are no known exploits in the wild, and the severity is considered low.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Since the vulnerability affects Chrome versions prior to 149.0.7827.53, updating to version 149.0.7827.53 or later is recommended if the vendor advisory confirms a fix. No other specific mitigations are indicated by the vendor.