The flaw is an improper input validation in Chrome’s compositor that allows an attacker who has already compromised the renderer process to craft a web page that mimics the address bar. This results in visual deception, leading users to trust malicious content and potentially divulge credentials or other sensitive information. The weakness does not give direct remote code execution; it primarily facilitates identity spoofing within the browser.

All desktop releases of Google Chrome prior to version 155.0.8059.39 are affected. The vulnerability only applies to systems running those older Chrome versions and has no impact on newer releases that contain the fix.

The CVSS score of 4.2 indicates a moderate impact, and the vulnerability is not listed in CISA’s KEV catalog and has no EPSS data, implying limited known exploitation. The likely attack vector is that the attacker must first gain control of the renderer process, which typically requires a prior local compromise or malware execution. Because the flaw is confined to users who run unpatched Chrome and have suffered a renderer compromise, its exploitation surface is relatively narrow.