Google Chrome versions prior to 157.0.8103.38 contain a UI misrepresentation flaw that allows a remote attacker to craft a web page which spoofs Chrome’s prompt UI elements. The spoofed prompts can be used to trick users into submitting sensitive information, enabling a phishing attack. The weakness is identified as CWE‑451 and does not provide direct code execution but facilitates user deception and potential data theft.

Desktops running Google Chrome before version 157.0.8103.38 are affected. No other vendors or products are listed, and no specific build variants are indicated.

The official severity is Medium. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a remote web page that the victim visits or receives through social engineering. Exploitation requires user interaction to accept the spoofed prompt, making the vulnerability effective only when the victim is lured into the malicious page. The lack of available exploitation evidence suggests that the risk is moderate, but the potential impact on user credentials warrants timely mitigation.