The flaw is a clickjacking vulnerability in the PermissionElement component of Google Chrome. By loading a crafted HTML page, a remote attacker can overlay UI elements that appear legitimate, luring a user to click permission dialogs or other controls. The primary impact is that unsuspecting users may unknowingly approve actions or grant permissions that they would normally refuse, potentially exposing data or allowing further malicious activity.

Google Chrome browsers running any build prior to version 155.0.8059.39 are affected. This includes stable channel releases before the referenced update. Users of other Chrome builds that have not applied the 155.0.8059.39 update remain vulnerable.

Exploitation requires an attacker to attract a victim to a crafted web page, often through social engineering. While the attack vector is remote and depends on user interaction, the susceptibility of the browser to overlay UI elements creates a moderate risk. The CVSS score of 5.4 indicates a medium severity. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, indicating that zero‑day exploits are not yet observed. Nonetheless, the medium Chromium security severity and the nature of the clickjacking weakness warrant prompt attention.