The flaw is an incorrect authorization on an unbounded UI element in Google Chrome versions before 155.0.8059.39. An attacker who has already compromised the renderer process could serve a crafted HTML page that causes Chrome to display spoofed user interface elements. This can trick users into interacting with UI components that appear to belong to a trusted site, potentially enabling phishing or the submission of sensitive data to the attacker. The weakness is an authorization bypass (CWE‑863).

Vendors: Google. Product: Google Chrome. Affected releases are all versions earlier than 155.0.8059.39.

The CVSS score is 4.2 indicating a moderate severity. The EPSS score is not available, so the exploitation probability is unknown. Because the vulnerability is not listed in CISA’s KEV catalog, it has not yet been widely exploited. The flaw requires an attacker to have previously compromised the renderer process. Once the renderer is compromised, the attacker can serve malicious pages that spoof UI elements, leading to phishing attacks or other deceptive interactions. The overall risk remains moderate until the patch is applied.