A web‑browser flaw in Google Chrome on macOS before 155.0.8059.39 allows a remote attacker to craft network traffic that causes the Chromoting UI to display forged elements. This activity is classified as UI Spoofing under CWE-451, enabling the attacker to present fake dialog boxes or icons that appear to be part of the browser. The attacker exploits social engineering tactics, such as phishing, to trick users into interacting with the falsified UI.

All users running Google Chrome on macOS with a revision prior to 155.0.8059.39 are affected. The vulnerability is tied to the Chromoting component of the browser and does not affect other Google products.

The vulnerability has a CVSS score of 5.4, no EPSS value, and is not listed in the CISA KEV catalog, which suggests that widespread exploitation has not been documented. However, the flaw can be leveraged by sending specially crafted packets over a network that the victim uses, and because it relies on social engineering, successful exploitation depends on user interaction rather than automated hacking. The risk is moderate for users who frequently interact with untrusted web content, especially if Chromoting is enabled.