The flaw allows a remote attacker to deliver a crafted HTML page that misrepresents user interface elements in Google Chrome. The forged dialogs, buttons, or input fields can trick users into providing sensitive data or executing unintended actions, compromising confidentiality and potentially the integrity of credentials entered through the interface.

Google Chrome desktop browsers with a version number earlier than 157.0.8103.38 are vulnerable. This includes all operating systems that support the desktop channel of Chrome.

Chromium rates the vulnerability as medium severity. No EPSS score is available and the flaw is not listed in the CISA KEV catalog, suggesting limited evidence of active exploitation. The attack vector is remote; a malicious web page can be served over HTTP or HTTPS and deliver the spoofed UI to an unwary user. While the lack of known widespread attacks reduces immediate pressure, the nature of the flaw makes it attractive for targeted social‑engineering campaigns.