This vulnerability involves a policy bypass in Blink within Google Chrome before version 147.0.7727.55 that enables remote attackers to conduct UI spoofing attacks via crafted HTML content. UI spoofing can mislead users by displaying deceptive interface elements, potentially facilitating phishing or other social engineering attacks. The issue was publicly disclosed on April 8, 2026, and Google has released an update to mitigate it. No CVSS score is provided, but the Chromium security team rates it as medium severity.

Successful exploitation could allow an attacker to present deceptive user interface elements to users, potentially tricking them into performing unintended actions. This could undermine user trust and facilitate phishing attacks. However, there are no reports of active exploitation in the wild, and the impact is limited to UI spoofing rather than direct code execution or data compromise.

Users and administrators should update Google Chrome to version 147.0.7727.55 or later, where this vulnerability has been addressed. The vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html confirms the availability of this update. No additional mitigation steps are indicated by the vendor.