This vulnerability arises from an inappropriate implementation in the PageInfo feature of Google Chrome before version 150.0.7871.47. A remote attacker with control over the renderer process can exploit this flaw to spoof the user interface by crafting malicious HTML content. The issue is classified under CWE-451 (Insufficient Policy Enforcement). The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. There is no explicit vendor advisory statement on remediation level, but the affected version is identified as prior to 150.0.7871.47.

The vulnerability allows an attacker who has already compromised the renderer process to perform UI spoofing, potentially misleading users by displaying deceptive interface elements. This can lead to integrity issues such as tricking users into performing unintended actions. There is no direct impact on confidentiality or availability according to the CVSS vector and description.

The vulnerability affects versions prior to 150.0.7871.47. Users and administrators should update Google Chrome to version 150.0.7871.47 or later to remediate this issue. The vendor advisory linked (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html) should be consulted for confirmation and further guidance. Patch status is not explicitly stated but the presence of the fixed version implies an official fix is available.