A flaw in Chrome’s session handling permitted a compromised renderer process to use a released resource, allowing a remote attacker to craft a page that rendered spoofed UI elements. The attacker could trick users into interacting with UI components that appear legitimate but are controlled by malicious code. This vulnerability is categorized as CWE‑672 (Untrusted Switch or Resource).

The flaw affected all users running any Chrome version prior to 155.0.8059.39. This includes desktop releases of Google Chrome on all operating systems. Users should check their installed version and consider upgrading if older.

The risk is considered low in Chromium’s severity assessment; however, exploitation requires the attacker to first achieve renderer process compromise, a non‑trivial prerequisite. No EPSS score is published, and the vulnerability is not in the CISA KEV catalog. The likely attack vector is a malicious web page delivered via an unsafe site that, together with a renderer compromise, triggers UI spoofing. Given the compound requirement, the probability of real‑world exploitation is low but not zero. The CVSS score of 4.2 confirms its low severity classification.