An incorrect authorization check in the Chrome extensions framework allowed a remote attacker to craft an extension that could spoof user interface elements. The affected code path could be abused to create deceptive pop‑ups or dialogs that appear to come from legitimate web pages, enabling phishing or other social engineering attacks. The Chromium security severity for this flaw was rated as medium, indicating potential for convincing users to perform unintended actions.

This vulnerability affects Google Chrome versions prior to 155.0.8059.39 on desktop platforms. Any installation of Chrome that has not yet been updated to this release or later is subject to the weakness.

The CVSS score of 4.8 indicates medium severity. No EPSS score is currently available and the vulnerability has not been reported in the CISA KEV catalog, which suggests public exploitation has not yet been observed. However, the flaw allows an attacker to supply a malicious extension, typically hidden behind a social–engineering approach, and then spoof UI elements. Because the attack requires only the user to grant the extension permission upon installation, the risk to users of untrusted or unknown extensions remains moderate and poses a realistic threat if social engineering succeeds.