This vulnerability is an incorrect authorization flaw in Chrome’s isolated mode that allows a remote attacker, via a crafted HTML page, to spoof user interface elements. The spoofed elements can appear as legitimate prompts or controls, potentially tricking users into providing sensitive information or performing unintended actions. The weakness is classified as a CWE‑863, indicating that improper authorization could lead to unauthorized access to privileged UI rendering contexts.

Google Chrome browsers running versions earlier than 157.0.8103.38 are affected. The issue arises in the isolated mode component shipped with these versions.

The Chromium security team rates the severity of the flaw as low, and no EPSS score is available. The vulnerability is not listed in CISA’s KEV catalog and requires a user to load a specifically constructed HTML page from a remote source. Exploitation would rely on a typical remote attack vector, but the impact is confined to UI spoofing without compromise of underlying system credentials or data.