This vulnerability involves an inappropriate implementation in Google Lens within Google Chrome versions before 151.0.7922.72. An attacker with control over the renderer process can exploit this flaw to conduct UI spoofing attacks by crafting malicious HTML content. The issue is tracked as CWE-451 (Incorrect Expression of User Interface in Web Page). The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact.

The impact is limited to UI spoofing, which can mislead users by presenting deceptive interface elements. There is no direct confidentiality or availability impact. The attacker must have already compromised the renderer process, which limits the scope of exploitation. No active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for current remediation guidance. Users should update to Chrome version 151.0.7922.72 or later once confirmed. Until then, no specific mitigation steps are provided by the vendor.