A race condition in Google Chrome’s browser engine before version 155.0.8059.39 allows a remote attacker, who has already compromised the renderer process, to deliver a crafted HTML page that overrides legitimate user interface elements. The attacker can then set up deceptive prompts or intermix malicious content with real page elements, potentially causing users to divulge credentials or perform unintended actions. This flaw is categorized as CWE‑367, reflecting a use‑after‑return or similar race condition that can alter rendering order.

The vulnerability affects all desktop installations of Google Chrome running any version prior to 155.0.8059.39 on Windows, macOS, or Linux. Any user relying on a legacy Chrome build is susceptible until the patch is applied.

The exploit requires an attacker to already compromise the renderer process, indicating a conditional or pre‑existing breach. Because the described condition is not trivial to achieve from a clean system and no exploits are listed in CISA’s KEV catalogue, the risk is considered low. The EPSS score is unavailable, and no publicly known exploitation has been documented, but organizations should still treat this flaw as a priority to prevent UI spoofing attacks with an updated Chrome version. The CVSS score of 4.2 indicates low severity.