UI spoofing in Google Chrome for iOS prior to 150.0.7871.47 enables a remote unauthenticated attacker to misrepresent browser interface elements - such as the address bar or security indicators - through a specially crafted HTML page, potentially deceiving users about the origin or trustworthiness of web content. The CVSS vector (PR:N, UI:R) confirms no authentication is required but user interaction is necessary, and the SSVC framework rates exploitation as 'none' with partial technical impact. EPSS at 0.21% (11th percentile) and the absence of any KEV listing or public exploit code indicate no public exploitation activity at time of analysis.
UI spoofing in Google Chrome's Paint rendering component (all versions prior to 150.0.7871.47) allows a remote unauthenticated attacker to misrepresent browser interface elements by luring a user to a crafted HTML page. The flaw stems from an inappropriate implementation in the Paint subsystem (CWE-451), enabling visual manipulation of browser UI state to deceive users into false trust decisions. No public exploit has been identified, SSVC rates exploitation as none, and EPSS sits at the 11th percentile - making this a low-urgency patch despite Chrome's near-ubiquitous deployment footprint.
UI spoofing in Google Chrome's PageInfo component (prior to 150.0.7871.47) allows a remote unauthenticated attacker to mislead users about a page's security context or origin by serving a crafted HTML page. The flaw stems from insufficient policy enforcement in PageInfo - the browser panel users rely on to assess site trustworthiness - and maps to CWE-451 (UI Misrepresentation of Critical Information). No public exploit code has been identified and CISA has not listed this in KEV; EPSS at 0.21% (11th percentile) and SSVC exploitation status of 'none' indicate no observed active exploitation at time of analysis.
UI spoofing in Google Chrome's Paint component prior to version 150.0.7871.47 allows a remote, unauthenticated attacker to misrepresent critical interface elements by delivering a crafted HTML page to a victim. The root cause is an inappropriate implementation in the Paint rendering subsystem (CWE-451), enabling visual deception that could facilitate phishing or credential theft. No public exploit code has been identified and CISA SSVC rates exploitation as none, placing real-world risk well below what the network-reachable attack vector might imply.
UI spoofing via inappropriate History implementation in Google Chrome prior to 150.0.7871.47 allows a remote attacker to present falsified browsing context to a victim through a crafted HTML page. The flaw (CWE-451) permits manipulation of how history entries are represented in the browser's UI, potentially misleading users about their navigation state or visited URLs. No public exploits are known, EPSS probability sits at 0.21% (11th percentile), and CISA SSVC confirms no active exploitation, placing this firmly in the monitor-and-patch category rather than emergency response.
UI spoofing in Google Chrome's Passwords component (all versions prior to 150.0.7871.47) enables remote, unauthenticated attackers to misrepresent critical interface elements to users via a specially crafted HTML page. The flaw stems from an inappropriate implementation (CWE-451) in Chrome's password management UI, meaning a malicious page can render deceptive credential-related prompts or overlays that appear to originate from the browser's trusted Passwords subsystem. No public exploit code has been identified and CISA SSVC rates active exploitation as none, making this a moderate-priority patching item rather than an emergency response.
Cross-origin data leakage in Google Chrome's PerformanceAPI implementation (versions prior to 150.0.7871.47) allows a remote unauthenticated attacker to infer sensitive data from other browser origins by luring a victim to visit a crafted HTML page. The flaw exploits timing measurements exposed by the Performance API to create a side-channel that bypasses the Same-Origin Policy for limited data reads. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS probability stands at 0.21% (11th percentile), consistent with SSVC's 'exploitation: none' assessment.
UI spoofing in Google Chrome for Android's SiteSettings component (versions prior to 150.0.7871.47) enables remote attackers to deceive users about site origin or permission context via a crafted HTML page. Rooted in CWE-451 (UI Misrepresentation of Critical Information), this flaw could cause victims to grant permissions to unintended origins or trust fraudulent site identity indicators. No public exploit or active exploitation has been identified; CISA SSVC and EPSS both confirm minimal real-world exploitation pressure at this time.
UI spoofing in Google Chrome for iOS prior to version 150.0.7871.47 allows a remote attacker to misrepresent browser interface elements - such as the address bar or origin indicators - by serving a crafted HTML page, potentially deceiving users into trusting malicious content. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms network-reachable exploitation with no privilege requirement but mandatory user interaction, limiting impact to partial integrity loss with no confidentiality or availability effect. No public exploit or active exploitation has been identified; an EPSS score of 0.21% at the 11th percentile indicates very low current exploitation probability, and this vulnerability does not appear in the CISA KEV catalog.
UI spoofing in Google Chrome's Safe Browsing component on iOS enables remote attackers to mislead users through a crafted HTML page, potentially causing them to dismiss or misinterpret security warnings. Only Chrome for iOS versions prior to 150.0.7871.47 are affected; the desktop channel is not impacted by this specific flaw. No public exploit code exists and exploitation probability is very low (EPSS 0.21%, 11th percentile), though the network-accessible, zero-authentication attack surface keeps it relevant where phishing-style delivery is feasible.
UI spoofing via Chrome's Geolocation implementation (versions prior to 150.0.7871.47) allows a remote, unauthenticated attacker to deceive users about the origin or context of geolocation permission requests through a crafted HTML page. Exploitation requires user interaction with the malicious page, limiting automated attack potential. With EPSS at 0.21% (11th percentile), no CISA KEV listing, and no public exploit identified, real-world exploitation risk is low despite the broad deployment footprint of Chrome.
UI spoofing in Google Chrome Enterprise prior to version 150.0.7871.47 allows unauthenticated remote attackers to deceive users into believing they are interacting with legitimate browser UI by serving a crafted HTML page. The root cause is insufficient validation of untrusted HTML input within Chrome's Enterprise component (CWE-20), enabling an attacker to manipulate visual elements such as address bars, dialog prompts, or permission requests. No public exploit has been identified at time of analysis and EPSS sits at 0.21% (11th percentile), indicating low current exploitation probability despite a network-accessible attack vector.
No-referrer policy bypass in Google Chrome for iOS prior to 150.0.7871.47 allows a remote attacker to capture referrer URL information that the browser was supposed to suppress. Exploitation requires user interaction - the victim must visit a crafted HTML page served by the attacker - and exploits a client-side enforcement gap (CWE-602) specific to the iOS build of Chrome. EPSS is 0.19% (9th percentile) and no active exploitation or KEV listing exists, consistent with the Low Chromium severity rating.
Navigation restriction bypass in Google Chrome for iOS prior to 150.0.7871.47 allows a remote, unauthenticated attacker to circumvent browser-enforced navigation controls by delivering a crafted HTML page. The flaw is confined to the iOS platform - Chrome on Android, Windows, macOS, and Linux is unaffected - and requires the victim to actively visit the attacker-controlled page (UI:R). With a CVSS score of 4.3 (Medium), an EPSS of 0.19% (9th percentile), no CISA KEV listing, and a Chromium-internal severity rating of Low, this vulnerability carries minimal real-world exploitation risk but warrants patching given its zero-privilege attack vector.
Same-origin-policy bypass in Google Chrome's Speech component before 150.0.7871.47 lets a remote attacker who lures a victim to a crafted HTML page cross origin boundaries via insufficient policy enforcement. No public exploit identified at time of analysis and EPSS is low (0.18%, 8th percentile); notably, Google's own Chromium team rated this Low severity even though NVD scored it CVSS 9.6, a significant conflict defenders should weigh. Requires user interaction (visiting the page) and affects all Chrome desktop builds prior to the fixed stable release.
Same-origin policy bypass in Google Chrome's Network component (versions prior to 150.0.7871.47) allows a remote attacker to violate cross-origin isolation by delivering a crafted HTML page to a victim. The flaw, rooted in CWE-346 (Origin Validation Error), enables unauthorized cross-origin integrity impacts - an attacker can cause a browser to act on or submit data across origin boundaries it should enforce. With an EPSS of 0.18% at the 8th percentile, no CISA KEV listing, and no public exploit identified, active exploitation risk is low at this time, though Chrome's ubiquitous deployment ensures broad attack surface if exploitation techniques mature.
Content Security Policy bypass in Google Chrome prior to 150.0.7871.47 allows a remote attacker to circumvent network-level policy enforcement by delivering a crafted HTML page to a victim. The Chrome security team internally rated this as Low severity, consistent with the CVSS 4.3 score and an impact limited to integrity (I:L) with no confidentiality or availability consequences. No public exploit code or active exploitation has been identified; EPSS places this in the 8th percentile of exploitation likelihood.
Navigation restriction bypass in Google Chrome's WebXR component affects all versions prior to 150.0.7871.47, exploitable by a remote unauthenticated attacker who can induce a user to visit a crafted HTML page. The root cause is insufficient input validation (CWE-20) within the WebXR subsystem, resulting in limited integrity impact via unauthorized navigation. No public exploit exists and EPSS sits at 0.18% (8th percentile), consistent with the Chromium team's own Low severity classification - this represents a genuine but low-priority risk.
Same-origin policy bypass in Google Chrome's FedCM (Federated Credential Management) implementation allows remote attackers to perform limited cross-origin integrity manipulation by luring a victim to a crafted HTML page. All Chrome versions prior to 150.0.7871.47 are affected. With an EPSS of 0.18% (8th percentile), no CISA KEV listing, and no public exploit identified, this represents a low-probability exploitation scenario despite being trivially deliverable via a web page.
Navigation restriction bypass in Google Chrome prior to 150.0.7871.47 allows a remote attacker to circumvent network-layer policy enforcement by inducing a user to visit a specially crafted HTML page. Rooted in CWE-602 (client-side enforcement of server-side security), the flaw means Chrome's network policy checks governing navigation can be subverted client-side, yielding a low-integrity impact with no confidentiality or availability consequence. No public exploit has been identified and the EPSS exploitation probability stands at 0.18% (8th percentile), consistent with Chromium's own 'Low' severity rating - this is a low-urgency but genuine policy-enforcement gap.
FileSystem policy enforcement bypass in Google Chrome prior to version 150.0.7871.47 allows a remote attacker to circumvent discretionary access control via a crafted HTML page, resulting in limited unauthorized write operations within the browser's sandboxed filesystem scope. The vulnerability requires user interaction - the victim must navigate to a malicious page - and produces only an integrity impact (I:L) with no confidentiality or availability consequence. With an EPSS of 0.18% (8th percentile) and no CISA KEV listing, real-world exploitation probability is very low; no public exploit has been identified at time of analysis.
Same-origin policy bypass in Google Chrome's CustomTabs component on Android (versions prior to 150.0.7871.47) permits remote attackers to perform limited cross-origin integrity violations by directing a victim to a crafted HTML page. The flaw is classified as CWE-346 (Origin Validation Error), meaning Chrome's CustomTabs implementation incorrectly validates or enforces origin boundaries when rendering attacker-controlled content. No active exploitation has been confirmed (not in CISA KEV) and the EPSS score of 0.18% (8th percentile) reflects very low observed exploitation probability, consistent with the Low severity rating assigned by the Chromium security team.
Same-origin policy bypass in Google Chrome's GetUserMedia implementation prior to version 150.0.7871.47 allows a remote, unauthenticated attacker to achieve limited cross-origin integrity impact by delivering a crafted HTML page to a victim. Chromium's own severity classification is Low, consistent with the CVSS 4.3 score and an EPSS exploitation probability of just 0.18% (8th percentile). No public exploit code and no active exploitation have been identified at time of analysis; Google has issued a remediated build in Chrome 150.0.7871.47.
WebXR implementation flaw in Google Chrome on Android prior to 150.0.7871.47 permits remote attackers to bypass navigation restrictions by delivering a crafted HTML page to a victim. The vulnerability is Android-specific and requires user interaction to trigger, constraining its reach. With no CISA KEV listing, no public exploit identified at time of analysis, and an EPSS of 0.18% (8th percentile), this represents a low-priority integrity issue that Google itself rates as Low severity.
UI spoofing in Google Chrome's Passwords feature on iOS (versions prior to 150.0.7871.47) enables remote attackers to manipulate the presentation of security-critical password UI elements via a specially crafted HTML page. Users who visit a malicious page in Chrome on iOS may see misleading security indicators or spoofed password dialogs, potentially deceiving them into unintended credential interactions. No public exploit identified at time of analysis; EPSS is 0.18% (8th percentile), and SSVC confirms no observed exploitation - risk is real but low-priority relative to the broader threat landscape.
Domain spoofing via incorrect security UI in Google Chrome's Document Picture-in-Picture feature on Android (prior to 150.0.7871.47) allows a remote attacker to deceive users about the origin of displayed content. By serving a crafted HTML page, an attacker can cause Chrome on Android to render a misleading security UI - misrepresenting the domain shown to the user. No public exploit has been identified at time of analysis, EPSS sits at 0.18% (8th percentile), and SSVC rates exploitation as none, making this a low operational priority despite its network-accessible attack vector.
UI spoofing in Google Chrome for Android prior to 150.0.7871.47 enables remote unauthenticated attackers to deceive users about page origin or content through insufficient validation of untrusted input in the browser's Input component. Exploitation requires user interaction - a victim must visit a crafted HTML page - and produces only limited integrity impact (visual deception), with no code execution or data exfiltration capability. No public exploit identified at time of analysis; EPSS sits at 0.18% (8th percentile) and CISA SSVC confirms zero observed exploitation, consistent with Google's own 'Low' severity classification for this Chromium issue.
UI spoofing in Google Chrome for iOS prior to 150.0.7871.47 allows a remote, unauthenticated attacker to misrepresent browser interface elements by delivering a crafted HTML page to a victim who visits it. Rooted in CWE-451 (UI Misrepresentation of Critical Information), the flaw arises from insufficient validation of untrusted HTML input in the iOS-specific Chrome rendering pipeline, enabling manipulation of trust signals such as address bar display or security indicators. No public exploit identified at time of analysis; EPSS at 0.18% (8th percentile) and SSVC Exploitation: none confirm negligible current threat actor interest.
UI spoofing in Google Chrome's Omnibox (address bar) prior to version 150.0.7871.47 allows a remote attacker to misrepresent origin or security indicators to a victim via a crafted HTML page. Rooted in CWE-451 (misrepresentation of critical security information), the flaw can enable phishing or origin-confusion attacks by deceiving users into trusting a false domain indicator. No public exploit code exists, CISA SSVC rates exploitation as none, and the EPSS score of 0.18% (8th percentile) confirms this is low-priority outside phishing-sensitive deployments.
Omnibox spoofing in Google Chrome for iOS prior to 150.0.7871.47 enables remote attackers to display false URL content in the browser's address bar by luring a user to a crafted HTML page, creating a credible phishing vector. The flaw stems from inappropriate implementation in the iOS-specific Omnibox rendering logic (CWE-451), distinct from Chrome's desktop codebase. No public exploit code has been identified and EPSS sits at 0.18% (8th percentile), indicating negligible opportunistic exploitation probability at this time.
UI spoofing in Google Chrome's Printing subsystem (all versions prior to 150.0.7871.47) can be triggered by a remote attacker who has already compromised the renderer process, enabling misrepresentation of critical browser UI via a crafted HTML page. This is a post-exploitation primitive rather than an initial-access vector - the renderer must be independently compromised before this flaw is reachable. No public exploit code exists and CISA SSVC rates exploitation as none, consistent with the low EPSS score of 0.18% (8th percentile), placing real-world urgency squarely in routine maintenance rather than emergency response.
Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 150.0.7871.47 allows a remote attacker to display a fraudulent URL in the browser's address bar by delivering a crafted HTML page. The root cause is classified as CWE-451 (UI Misrepresentation of Critical Information), meaning the security UI fails to accurately reflect the true origin of displayed content - a condition that directly undermines phishing defenses. No public exploit code has been identified at time of analysis, and the EPSS score of 0.18% (8th percentile) indicates very low observed exploitation pressure, consistent with the Chromium team's own 'Low' severity rating.
Cross-origin data leakage in Google Chrome's DevTools component (all versions prior to 150.0.7871.47) enables remote attackers to exfiltrate sensitive cross-origin information by convincing a victim to perform specific UI gestures on a crafted HTML page. The flaw stems from CWE-20 (Improper Input Validation) within DevTools, allowing the Same-Origin Policy to be bypassed under attacker-directed user interaction. No active exploitation is confirmed - SSVC rates exploitation as 'none,' EPSS is 0.18% (8th percentile), and the vulnerability is absent from the CISA KEV catalog - with a vendor-released patch available as Chrome 150.0.7871.47.
UI spoofing in Google Chrome's DarkMode implementation (all versions prior to 150.0.7871.47) enables remote attackers to misrepresent page content or interface elements by serving a crafted HTML page to a victim. The flaw is classified under CWE-451 (UI Misrepresentation of Critical Information), meaning the rendering pipeline fails to present information accurately, potentially deceiving users into unsafe actions such as credential entry or approval of deceptive prompts. No public exploit has been identified at time of analysis, EPSS is 0.18% (8th percentile), and CISA's SSVC framework rates exploitation as none - signals that collectively place this at low operational priority despite its network reachability.
Unauthorized user profile disclosure in Red Hat Build of Keycloak allows low-privileged administrative users to bypass Fine-Grained Admin Permission (FGAPv2) restrictions and access complete user profiles they should only be permitted to search. An admin scoped exclusively to user-search rights can invoke the 'brute-force-user' endpoint to retrieve sensitive profile data and security metadata, circumventing the intended view-permission gate on that code path. No public exploit has been identified and the flaw is not listed in CISA KEV, but its network-accessible, low-complexity nature makes it straightforward to abuse within any Keycloak deployment that has activated FGAPv2 permission delegation.
Information disclosure in Coolify allows any authenticated API user to enumerate domain names (FQDNs) of applications belonging to other teams. The issue exists in versions before 4.0.0-beta.464 and is fixed in that release. No active exploitation or public exploit code has been identified, and EPSS predicts very low exploitation probability.
UI spoofing via Google Chrome's Autofill implementation on Android (prior to 150.0.7871.47) allows remote unauthenticated attackers to misrepresent interface elements through a crafted HTML page, potentially deceiving users into disclosing sensitive input or taking unintended actions. The vulnerability is platform-specific to Android and carries a Chromium-internal severity of Low, consistent with its limited integrity-only impact and requirement for user interaction. No public exploit code or active exploitation has been identified at time of analysis, and EPSS probability sits at 0.17% (7th percentile), confirming minimal real-world threat pressure.
Domain spoofing in Google Chrome for Android (versions prior to 150.0.7871.47) allows remote attackers to deceive users about the origin of a webpage by exploiting incorrect rendering of security-critical UI elements via a crafted HTML page. User interaction is required - the victim must navigate to the attacker-controlled page - and impact is limited to integrity (UI misrepresentation), with no direct confidentiality or availability consequences. No active exploitation is confirmed (not in CISA KEV) and EPSS of 0.17% at the 7th percentile reflects minimal real-world exploitation activity; Google itself rates this 'Low' severity.
UI spoofing in Google Chrome's PopupBlocker component (all versions prior to 150.0.7871.47) enables a remote attacker who has already compromised the Chrome renderer process to manipulate browser UI elements through a crafted HTML page. The integrity impact is limited to UI deception - no code execution, credential theft, or availability impact is possible through this flaw alone. EPSS at 0.17% (7th percentile) and Chromium's own 'Low' severity rating align with the constrained exploit chain; no public exploit or CISA KEV listing exists at time of analysis.
Omnibox (URL bar) spoofing in Google Chrome on macOS prior to version 150.0.7871.47 enables a remote attacker to display a falsified URL in the browser's address bar by delivering a crafted HTML page exploiting an inappropriate Select element implementation. The deception targets the user's trust in the origin indicator - the primary browser security signal - making this a phishing and social engineering enabler rather than a direct code execution or data exfiltration vector. No public exploit exists and EPSS exploitation probability stands at 0.17% (7th percentile), with no confirmed active exploitation; vendor-released patch is available in Chrome 150.0.7871.47.
UI spoofing in Google Chrome's SplitView feature prior to version 150.0.7871.47 enables remote attackers to misrepresent the origin or content of browser UI elements by delivering a crafted HTML page to a victim. Exploitation is limited to integrity impact only - no data exfiltration or availability disruption is possible directly - though the spoofing could facilitate social engineering leading to credential theft. No public exploit code exists and EPSS is negligible at 0.17% (7th percentile), classifying this as a routine-patch-cycle item despite Chrome's ubiquitous deployment.
Cross-origin data leakage in Google Chrome's Extensions subsystem (versions prior to 150.0.7871.47) enables a remote attacker - who has first achieved renderer process compromise - to bypass same-origin policy enforcement and read cross-origin data via a specially crafted HTML page. The flaw is classified as CWE-346 (Origin Validation Error) and rated Low severity by the Chromium security team. EPSS is extremely low at 0.17% (7th percentile), no CISA KEV listing exists, and no public exploit code has been identified, consistent with the significant chained exploitation barrier imposed by the renderer-compromise prerequisite.
Cross-origin data leakage in Google Chrome's Network component (versions prior to 150.0.7871.47) enables a remote attacker who has already compromised the renderer process to exfiltrate cross-origin data via a specially crafted HTML page. This is a chained vulnerability - renderer-process compromise is a hard prerequisite, meaning real-world risk is substantially lower than the network-accessible CVSS vector implies. No public exploit code has been identified and EPSS sits at the 7th percentile (0.17%), consistent with limited exploitation interest. Google has released a fix in the stable channel update to 150.0.7871.47.
UI spoofing in Google Chrome's Isolated Web Apps (IWA) subsystem allows remote unauthenticated attackers to misrepresent security-relevant interface elements to victims via a specially crafted HTML page, affecting all Chrome versions prior to 150.0.7871.47. The vulnerability is rooted in CWE-451 (UI Misrepresentation of Critical Information) and is limited to low-integrity impact with no confidentiality or availability consequence. No public exploit identified at time of analysis; EPSS at 0.17% (7th percentile) and SSVC exploitation status of 'none' both indicate negligible real-world exploitation likelihood.
UI spoofing in Google Chrome's File Input component (versions prior to 150.0.7871.47) enables remote unauthenticated attackers to misrepresent the file selection interface through a crafted HTML page, potentially deceiving users into interacting with fraudulent UI elements. The flaw is classified as CWE-451 (UI Misrepresentation of Critical Information) and requires active user interaction with the malicious page, consistent with the CVSS UI:R metric. No public exploit code exists, CISA SSVC confirms exploitation status as none, and EPSS sits at a low 0.17% (7th percentile), collectively indicating negligible real-world exploitation pressure.
UI spoofing in Google Chrome's WebXR subsystem (versions prior to 150.0.7871.47) is achievable by an attacker who has already compromised the renderer process, allowing manipulation of browser UI elements via a crafted HTML page. The vulnerability is a second-stage attack component, not a standalone entry point - exploitation chains through a separate renderer compromise before WebXR's insufficient input validation can be abused. EPSS at 0.17% (7th percentile) and no CISA KEV listing indicate minimal observed exploitation activity; patch is available as of Chrome 150.0.7871.47.
UI spoofing in Google Chrome prior to version 150.0.7871.47 is caused by an inappropriate SVG rendering implementation, enabling remote attackers to visually misrepresent browser UI elements through a crafted HTML page. Exploitation requires user interaction - the victim must visit a malicious page - and the direct impact is limited to integrity via visual deception, with no confidentiality or availability consequence. No public exploit has been identified and the EPSS score of 0.17% (7th percentile) confirms minimal exploitation activity at time of analysis.
UI spoofing via crafted HTML page in Google Chrome's Credential Management implementation on Android (all versions prior to 150.0.7871.47) allows a remote, unauthenticated attacker to misrepresent credential-related interface elements, potentially tricking users into submitting credentials to unintended destinations. The vulnerability is platform-scoped to Android and requires user interaction with the malicious page. No active exploitation has been confirmed - the CVE is absent from CISA KEV, EPSS stands at 0.17% (7th percentile), and SSVC lists exploitation status as none.
UI spoofing in Google Chrome for iOS prior to version 150.0.7871.47 enables remote attackers to manipulate browser interface elements through a specially crafted HTML page, potentially deceiving users into believing they are interacting with a trusted site. The flaw arises from insufficient validation of untrusted input (CWE-20) in the iOS-specific Chrome layer and requires user interaction - a victim must navigate to a malicious page. No public exploit exists, CISA has not listed this in KEV, and an EPSS score of 0.17% (7th percentile) confirms very low real-world exploitation probability at the time of analysis.
UI spoofing in Google Chrome Mobile on Android prior to version 150.0.7871.47 enables remote unauthenticated attackers to misrepresent security-critical information in the browser interface by serving a crafted HTML page. Rooted in CWE-451 (User Interface Misrepresentation of Critical Information), the flaw allows manipulation of Chrome's mobile security UI - such as origin indicators or trust signals - without requiring any privileges from the attacker. No active exploitation is confirmed (absent from CISA KEV), EPSS sits at the 7th percentile, and SSVC flags exploitation status as none, placing this firmly in the monitor-and-patch tier rather than emergency response.