This vulnerability in Google Chrome involves insufficient validation of untrusted input, which can be exploited by a remote attacker to conduct UI spoofing attacks through specially crafted HTML content. The issue affects Chrome versions before 149.0.7827.103. The CVSS vector indicates the attack requires no privileges but user interaction, with low confidentiality impact and low availability impact. The vendor advisory is available but does not explicitly state if a fix has been released.

An attacker can remotely induce a user to interact with a spoofed user interface element, potentially misleading the user. The impact is limited to UI spoofing with low confidentiality and availability impact. There is no indication of code execution or privilege escalation. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html for current remediation guidance. Until official confirmation of a fix, users should exercise caution when interacting with untrusted web content. No specific temporary mitigations are provided by the vendor.