Google Chrome Compositing UI Spoofing Vulnerability

A UI spoofing vulnerability has been identified in Google Chrome versions prior to 140.0.7339.80. This issue arises from an inappropriate implementation in the compositing process, which allows remote attackers to create crafted HTML pages that deceive users by manipulating the user interface.

Impact

Exploitation of this vulnerability can lead to UI spoofing, where a maliciously crafted HTML page tricks users into interacting with permission prompts, potentially bypassing the intended denial of those permissions.

Reproduction

The vulnerability can be reproduced by embedding a 'permission' tag within a parent element that applies a 'webkit-text-stroke' style. This combination can obscure the text in the 'permission' tag, creating a false impression that a permission is being actively requested or acknowledged, even when it is not.

Remediation

Users can update to Google Chrome version 140.0.7339.80 or later to address this vulnerability.