The flaw permits a remote attacker who has already gained control of the renderer process to render a crafted HTML page that utilizes a released resource to alter the browser’s user interface. By spoofing UI elements, the attacker can create a misleading visual experience that may trick users into believing legitimate browser features or dialog boxes are present. The weakness aligns with CWE‑672, indicating that a lower‑privileged component can influence higher‑privileged functionality.

Google Chrome versions released before 155.0.8059.39 on desktop platforms are vulnerable. Systems running those builds are potentially exposed to spoofed UI elements if an attacker can compromise the renderer process via a malicious web page.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of current exploitation in the wild. Exploitation requires the attacker to have already compromised the renderer process, which restricts the attack surface to scenarios where malicious or compromised web content is delivered. The CVSS severity, with a score of 4.2, is classified as low, yet updating remains the recommended course of action.