The vulnerability involves an inappropriate implementation in the Paint component of Google Chrome before version 150.0.7871.47. This flaw enables a remote attacker to conduct UI spoofing attacks by crafting malicious HTML content. UI spoofing can mislead users by displaying deceptive user interface elements, potentially facilitating phishing or other social engineering attacks. The vulnerability is publicly known as CVE-2026-13979 and is categorized as medium severity by Chromium security. No detailed CVSS vector or score is available, and the vendor advisory link is provided but does not specify patch or remediation details in the input data.

Successful exploitation allows remote attackers to perform UI spoofing, which can deceive users by presenting fake or misleading interface elements. This may lead to user confusion or trick users into performing unintended actions. There is no indication of code execution, data leakage, or privilege escalation from the provided information.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Users and administrators should update Google Chrome to version 150.0.7871.47 or later once confirmed to contain the fix. Until then, be cautious of suspicious web content that may attempt UI spoofing.