This vulnerability arises from an inappropriate implementation in the Permissions component of Google Chrome versions before 149.0.7827.53. It enables a remote attacker to conduct UI spoofing attacks by crafting malicious HTML content. UI spoofing can mislead users by displaying deceptive interface elements, potentially tricking them into unintended actions. The issue is classified as low severity by Chromium security. The vulnerability was publicly disclosed on June 4, 2026. No CVSS score or detailed technical exploitation information is provided. The vendor advisory URL points to a stable channel update announcement but does not explicitly confirm patch availability for this specific issue.

The impact is limited to UI spoofing, which can deceive users by presenting fake interface elements. This may lead to user confusion or trick users into performing unintended actions. There are no reports of active exploitation in the wild. The severity is considered low by the Chromium security team, indicating a limited risk to users.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users and administrators should update Google Chrome to version 149.0.7827.53 or later once confirmed to contain the fix. Until then, be cautious with untrusted web content that might attempt UI spoofing.