The vulnerability stems from a UI misrepresentation bug that permits a remote attacker to craft a malicious web page that mimics legitimate Chrome UI elements. This can be leveraged for social‑engineering attacks, convincing users they are interacting with genuine browser prompts when in fact the attacker controls the content. The flaw does not provide direct code execution or network takeover; it primarily enables deceptive interactions that could lead to credential theft or delivery of malicious downloads.

Google Chrome versions prior to 155.0.8059.39 are affected. Users running any of those builds are at risk of being tricked by forged UI dialogs.

The CVSS score of 5.4 indicates a medium severity, consistent with Chromium's Low security severity label. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of exploitation. The likely attack vector involves a remote attacker delivering a malicious page to an unsuspecting user, relying on social engineering rather than automated exploitation techniques.