This vulnerability, tracked as CVE-2026-13966, affects Google Chrome versions before 150.0.7871.47. It is caused by an inappropriate implementation in the History feature, enabling remote attackers to conduct UI spoofing attacks through crafted HTML content. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and limited integrity impact. The vulnerability is categorized under CWE-451 (Incorrect Expression of User Interface Element). No known exploits in the wild have been reported. The vendor advisory linked does not explicitly confirm patch availability or remediation status.

The impact is limited to UI spoofing, which can deceive users by displaying misleading interface elements. There is no direct confidentiality, availability, or significant integrity impact. This could potentially facilitate phishing or social engineering attacks but does not itself compromise system security beyond UI deception.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Users and administrators should monitor official Google Chrome release notes and update to version 150.0.7871.47 or later once confirmed patched. Until then, exercising caution with untrusted web content is advised.