This vulnerability involves an inappropriate implementation in the Autofill component of Google Chrome before version 150.0.7871.47. It enables a remote attacker to conduct UI spoofing attacks by tricking users into specific UI interactions on maliciously crafted web pages. The issue is categorized under CWE-451 (Incorrect Expression of User Interface). The CVSS v3.1 base score is 4.2 (medium), reflecting network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact. The vendor advisory link is provided but does not explicitly state if the issue is patched or mitigated.

The vulnerability allows an attacker to spoof the user interface, potentially misleading users into interacting with deceptive UI elements. This can result in limited integrity and availability impacts but does not compromise confidentiality. There are no known exploits in the wild, and the attack requires user interaction and high attack complexity.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Until official confirmation, users should update to Chrome version 150.0.7871.47 or later if available. No additional specific mitigations are indicated by the vendor advisory.