A flaw in Google Chrome’s PermissionElement component before version 155.0.8059.39 allows a remote attacker to use social engineering via a crafted HTML page to alter the appearance of UI elements. The compromised interface can mislead users into believing they are interacting with legitimate Chrome prompts, potentially facilitating phishing or other deceptive attacks. This vulnerability can undermine confidence in Chrome’s permission dialogs and enable an attacker to create a convincing but false user interface.

Google Chrome users running versions prior to 155.0.8059.39 are affected. No specific sub‑versions beyond the quoted baseline are listed; the issue applies to all builds preceding that release.

Advanced exploitation requires the victim to visit a malicious page that contains misleading UI elements. Infected sites can coerce users into granting permissions under false pretenses. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating a moderate likelihood of widespread exploitation. Attackers typically rely on social‑engineering tactics rather than direct exploitation of network or code execution paths. The CVE severity is noted as medium in Chromium’s internal assessment.