The vulnerability is in FileAPI where UI elements can be misrepresented. A crafted HTML page can cause the browser to display fake UI elements. This allows a remote attacker to use social engineering to make users believe a legitimate dialog is present, potentially leading to credential theft or other phishing outcomes.

Google Chrome versions prior to 157.0.8103.38 are affected. Any operating system that runs this Chrome version is vulnerable.

The exploit requires a remote attacker to deliver a crafted HTML page to the victim. Since EPSS is not available and the vulnerability is not listed in KEV, the potential for widespread exploitation is unclear. The Chromium severity is Medium, suggesting moderate risk. Attackers would need to use social engineering to entice users to visit malicious sites, and the impact would be limited to the victim's browsing session.