This vulnerability involves an inappropriate implementation in the DevTools component of Google Chrome before version 148.0.7778.96. An attacker can exploit this by tricking a user into installing a crafted malicious Chrome extension, which then enables UI spoofing attacks. UI spoofing can mislead users by displaying deceptive user interface elements, potentially facilitating further social engineering or phishing attacks. The issue is classified as low severity by Chromium, and no known exploits are reported in the wild. The vendor advisory URL is provided but does not explicitly state the patch or remediation status.

The impact is limited to UI spoofing via a malicious extension installed by user consent. This could potentially deceive users into interacting with fake UI elements, but it requires user interaction to install the malicious extension. There are no reports of exploitation in the wild, and the severity is considered low.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html for current remediation guidance. Users should avoid installing untrusted Chrome extensions to mitigate risk. If an update to Chrome version 148.0.7778.96 or later is available, applying it is recommended once confirmed by the vendor advisory.