This vulnerability arises from an incorrect authorization check in Google Chrome's input handling, allowing a remote attacker’s crafted HTML to render UI elements that appear as native browser controls. The attacker can exploit this to spoof sensitive input fields, luring users into unknowingly submitting credentials or other confidential data. The flaw is classified as CWE‑863, highlighting that insufficient authorization checks lead to unauthorized presentation of UI elements.

Google Chrome desktop versions older than 155.0.8059.39 are impacted. Any user running those earlier releases on a desktop platform is susceptible to the spoofing attack.

The CVSS base score of 5.4 indicates medium severity; EPSS data is not available, and the vulnerability is not listed in CISA's KEV catalog. Exploitation requires a user to visit a malicious web page, making the attack vector remote and dependent on social engineering. Overall risk is moderate, with a medium severity score and the necessity of user interaction, but the lack of EPSS data and KEV inclusion suggests limited active exploitation in the wild.