This vulnerability is a flaw in Chrome's authorization checks that lets a remote attacker craft an HTML page to spoof the browser's address bar. It is an instance of CWE-863, Incorrect Authorization. The attacker can make users believe they are viewing a trusted site when they are not, creating a phishing or social‑engineering vector; the impact is limited to deception of the user and does not provide code execution or access to system resources.

Google's Chrome releases before version 155.0.8059.39 are affected; the vulnerability applies to all desktop builds of the stable channel listed in the referenced Chrome releases blog.

The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 5.4, corresponding to a medium severity rating in Chromium’s assessment. The likely attack vector is a crafted HTML page delivered over the network to a victim's browser; because the exploit requires the victim to open the malicious page, the success probability depends on user interaction with the page or a drive‑by opportunity. No privileged escalation or remote code execution is possible.