The vulnerability allows a remote attacker to spoof payment‑related user interface elements displayed in Google Chrome. By serving a crafted HTML page, the attacker can create fake prompts or confirm dialogs that appear to the user as legitimate payment dialogues. This enables social‑engineering attacks, tricking users into providing sensitive information or authorizing fraudulent transactions. The weakness is identified as CWE‑451.

Google Chrome versions prior to 155.0.8059.39 are affected. Users running any earlier release of the stable channel are vulnerable until the security update is applied.

The adverse effect is limited to social‑engineering success; no direct code execution or data exfiltration is described. The CVSS score is 5.4, indicating a moderate security risk. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating a low likelihood of widespread exploitation. The attack would likely require an initial user interaction with a malicious web page and some knowledge of the user’s trust in payment prompts. The security severity is classed as low by Chromium’s internal assessment.