This vulnerability involves an inappropriate implementation in the Geolocation feature of Google Chrome before version 150.0.7871.47. An attacker who has already compromised the renderer process can exploit this flaw to conduct UI spoofing attacks by crafting malicious HTML pages. The CVSS score of 6.5 reflects a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. There is no explicit vendor advisory stating a patch or remediation level, but the affected version is identified as prior to 150.0.7871.47.

The vulnerability allows an attacker with control over the renderer process to spoof the user interface, potentially misleading users. This can lead to integrity issues such as tricking users into performing unintended actions. There is no direct impact on confidentiality or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Users should update to version 150.0.7871.47 or later once confirmed. Until then, no specific mitigation beyond updating is available.