A crafted web page can make the browser display UI elements that appear to be part of Chrome’s own interface, making it look as though a genuine Chrome dialog or prompt is appearing. This flaw, based on UI misrepresentation (CWE‑451), allows a remote attacker to deceive users into interacting with deceptive UI, such as clicking a fake button or confirming unwanted actions, in a social‑engineering style attack. The vulnerability does not grant code execution but can influence user behavior and lead to credential or data disclosure if the user is tricked into submitting information to a malicious site.

Google Chrome versions earlier than 157.0.8103.38 on the stable channel are affected. Users should ensure they are running this or a newer release to avoid the flaw.

The flaw is assessed as low severity, with no officially published CVSS or EPSS score. It is not listed in the CISA KEV catalog. Exploitation requires the user to open a maliciously crafted HTML page, after which the attacker can manipulate the browser’s UI to emulate native Chrome dialogs. Because this type of social‑engineering attack depends on user interaction, the likelihood of widespread exploitation is limited, but any user who visits a hostile web page can be deceived.