The vulnerability is a missing authorization check in Chrome’s permissions implementation that allows an attacker, after compromising the renderer process, to forge interface elements and impersonate trusted UI. This can lead to deceptive prompts or buttons that trick users into giving away credentials or performing unintended actions. The issue is classified as medium severity and is mapped to CWE‑862.

All users of Google Chrome versions prior to 155.0.8059.39 are affected. The flaw exists in the stable Chrome channel and applies to any build before the specified revision.

The CVSS score is 4.2, indicating a moderate risk. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a previous compromise of the renderer process, typically achieved through another vulnerability. Once that process is compromised, the attacker can spoof UI without additional privileges, presenting a significant risk to users on unpatched browsers.