This vulnerability involves an incorrect security user interface in the Permissions section of Google Chrome on Windows before version 147.0.7727.55. The flaw enables a remote attacker to craft an HTML page that can spoof domains, potentially misleading users about the origin of content or permissions. The CVSS score of 6.5 reflects a medium severity with no confidentiality impact but high integrity impact, requiring user interaction and no privileges. No official remediation level or patch status is confirmed in the provided data, though the vendor advisory link is available for updates.

The vulnerability allows domain spoofing through the browser's security UI, which can mislead users and potentially facilitate phishing or social engineering attacks. There is no direct confidentiality or availability impact reported. No known exploits are currently active in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution when interacting with permission prompts and avoid clicking on suspicious links or pages that could exploit this UI flaw.