The vulnerability is a UI misrepresentation flaw (CWE‑451) in the Chromoting component of Google Chrome on macOS. By sending crafted network traffic, a remote attacker can cause Chrome to render false UI elements, allowing the attacker to impersonate legitimate interface components. This does not enable code execution or data exfiltration but can mislead users into taking undesired actions, facilitating social engineering attacks.

Affected systems are Google Chrome browsers running on macOS with versions prior to 155.0.8059.39, specifically those that include the Chromoting feature.

The CVSS score of 5.4 reflects a moderate impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to transmit malicious network traffic while the target user is using the Chromoting feature; the attack relies on user interaction, so the risk is primarily the deception of UI rather than direct system compromise. Patch deployment mitigates the vulnerability.