An incorrect authorization check in WebShare, identified as CWE‑863, allows a remote attacker who has already compromised the renderer process to inject or impersonate UI elements through a specially crafted HTML page. The attacker can spoof dialogs or other interface elements, potentially enabling phishing or social‑engineering attacks. The effect is limited to user interface spoofing; it does not provide code execution or data exfiltration.

Android users running Google Chrome versions older than 155.0.8059.39 are affected. The vulnerability is fixed in version 155.0.8059.39 and later.

The CVSS score of 4.2 indicates medium severity. No EPSS score is available, and the issue is not listed in CISA KEV, suggesting a moderate likelihood of exploitation. Exploitation requires a prior compromise of the renderer process, so a remote attacker must first inject malicious content or exploit another vulnerability to gain such control. Once renderer control is achieved, the attacker can spoof UI elements, misleading the user and facilitating deceptive interactions. Immediate patching is advised to eliminate the entire attack chain.