Executive brief
A vulnerability in the Google Chrome web browser could allow a malicious website to spoof parts of the browser's user interface. By tricking a user into visiting a specially crafted webpage, an attacker could display misleading information that appears to be part of the legitimate browser UI. This could be used to facilitate phishing attacks or deceive users into performing unintended actions.
Technical details
A UI spoofing vulnerability exists in the Paint component of Google Chrome. The flaw stems from an inappropriate implementation that fails to correctly isolate or validate rendering instructions when processing specific HTML content. A remote, unauthenticated attacker can exploit this by enticing a user to visit a malicious website, allowing the attacker to overlay or mimic browser UI elements. This can lead to user confusion or successful social engineering attacks. The issue is resolved in Chrome version 150.0.7871.47 and later.
Affected products
- Google Chrome prior to 150.0.7871.47
Timeline
- 2026-06-30: disclosed
- 2026-06-30: patched