This vulnerability arises from improper validation of untrusted input within the PDF implementation of Google Chrome before version 149.0.7827.53. An attacker with control over the renderer process can exploit this to conduct UI spoofing attacks using crafted HTML content. The issue is recognized as low severity by Chromium security, indicating limited impact or exploitability. The absence of a CVSS score and explicit remediation information suggests that patch status is not confirmed in the available data.

The impact is limited to UI spoofing, which could mislead users by presenting deceptive interface elements. Exploitation requires prior compromise of the renderer process, which is a significant prerequisite. There are no reports of active exploitation in the wild. The overall risk is considered low based on the vendor's severity rating.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Since no official fix or temporary workaround is indicated, users should monitor updates from Google and apply any available Chrome updates promptly once released.