A malicious webpage can cause Chrome to display UI elements that do not reflect the real state of the browser, enabling a social engineering attack that deceives users into performing unintended actions. The flaw arises from a misrepresentation of PermissionElement in Chrome, and it is classified as CWE‑451 (Incorrect Semantic Interpretation). The vulnerability does not provide direct code execution or data exfiltration, but it can be leveraged to trick users into granting permissions or clicking links that they believe are legitimate.

Google Chrome versions earlier than 157.0.8103.38 are affected. The bug is limited to the Chrome desktop browser and does not affect other Google products or browsers.

Chromium labels the issue as Medium severity and no EPSS score is publicly available, indicating the risk is moderate. The CVE is not listed in the CISA KEV catalog. Exploitation requires the victim to view a crafted HTML page and interact with the spoofed UI, making the attack vector primarily social engineering. Even though the impact is confined to user interaction, the potential for widespread phishing or credential theft justifies prompt remediation.