A flaw in Chrome's Chromoting feature enables a remote attacker to craft network traffic that causes UI elements in a Chrome Remote Desktop session to be misrepresented, allowing the attacker to display arbitrary content that appears to belong to the local application. This can be used to deceive users into interacting with malicious controls or entering credentials, constituting an impersonation vulnerability.

Affected systems are the Google Chrome browser on Windows operating systems running versions earlier than 155.0.8059.39. The vulnerability is specific to the Chromoting component, which implements Chrome Remote Desktop.

The CVSS score of 5.4 indicates low severity, no EPSS score is available, and it is not listed in the CISA KEV catalog. The attack vector is remotely reachable via crafted network traffic. Based on the description, it is inferred that the attacker must affect a target already participating in a Chrome Remote Desktop session. Based on the description, it is inferred that social engineering could raise the likelihood of a successful attack.