The flaw in Chrome’s WebAppInstalls component allows a remote attacker to spoof UI elements when a user visits a crafted HTML page. This incorrect authorization lets the attacker display deceptive interface elements that may trick a user into interacting with a malicious app installation or forging information. The impact is primarily in the realm of user deception and phishing, rather than direct data theft or code execution.

All Chrome browsers running a version earlier than 155.0.8059.39 are affected. The vendor is Google, product Chrome, with the critical vulnerability present in all releases preceding the specified patch level.

The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been actively exploited in the wild. The CVSS score is 5.4, which corresponds to a medium severity, and exploitation would require a victim to load a maliciously crafted HTML page in the affected browser. The lack of a high exploitation probability combined with the medium severity mitigates the overall risk, although targeted phishing campaigns could still leverage the UI spoofing capability.