A flaw in Google Chrome’s permission handling allows an attacker who has already compromised the renderer process to spoof user interface elements through a specially crafted HTML page. The vulnerability is classified as CWE-862, Authorization Bypass Through User-Controlled Key. The Chromium team assessed the impact as low, indicating that while UI elements can be spoofed, the attacker must already have code execution in the renderer context. No further direct effect on system data or control is described.

The issue exists in Google Chrome versions prior to 155.0.8059.39. Users running any older stable channel build should consider upgrading to the latest version to eliminate the flaw.

The attack requires the attacker to first compromise the renderer process, a condition stated in the description. Because the EPSS score is not available and the issue is not listed in CISA KEV, it is inferred that the likelihood of widespread exploitation is low, and the CVSS score of 4.2 indicates a low severity impact. If an attacker succeeds in compromising the renderer, they can masquerade UI elements. It is inferred that the overall risk is low, but mitigation may be prudent in systems where untrusted content or weakened sandboxing could lead to renderer compromise.