This vulnerability in Google Chrome's WebAppInstalls feature allows a remote attacker to conduct domain spoofing through crafted HTML content combined with user interaction involving specific UI gestures. The issue stems from an incorrect security UI that misleads users about the domain they are interacting with. The CVSS 3.1 base score is 4.2 (medium), reflecting network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact. The vulnerability affects Chrome versions prior to 150.0.7871.47.

An attacker who convinces a user to perform specific UI gestures on a maliciously crafted HTML page can spoof the domain displayed in the UI, potentially misleading the user about the authenticity of the site. This can lead to integrity issues such as phishing or social engineering attacks. There is no direct confidentiality impact reported. Availability impact is low.

Google has released Chrome version 150.0.7871.47 which addresses this vulnerability. Users and administrators should update to this version or later to remediate the issue. No additional mitigations are specified in the vendor advisory. Patch status is not explicitly confirmed in the advisory link provided, so users should verify update availability through official Chrome update channels.