Google Chrome versions before 157.0.8103.38 contain a flaw that allows a malicious webpage to spoof or modify the appearance of the Bluetooth dialog and related UI elements. The attacker can deliver a crafted HTML page that presents counterfeit controls or prompts, potentially tricking users into interacting with fake interfaces. This vulnerability is classified as CWE-451, a user interface spoofing weakness, and can lead to phishing or credential disclosure if the user trusts the altered UI.

All installations of Google Chrome prior to version 157.0.8103.38, across desktop platforms, are affected. The issue manifests in the Bluetooth subsystem regardless of operating system, meaning any user who runs the vulnerable browser is at risk when visiting a malicious page.

The Chromium team assessed the issue as Medium in internal severity, with no public CVSS score released. Exploitation requires a remote attacker to host a crafted HTML page that a user visits or loads; the attack does not need elevated privileges or code execution on the host. Because EPSS data is unavailable and the vulnerability is not listed in CISA's KEV catalog, evidence of public exploitation is limited. The attack vector is clearly remote via a web page, making it accessible to a broad audience of Chrome users.