The flaw originates from an inappropriate implementation within the Permissions handling of Google Chrome before build 150.0.7871.47. A remote attacker can deliver a crafted HTML page that triggers a forged permission request dialog, leading users to grant permissions they would otherwise deny. This is a purely deceptive UI manipulation and does not provide code execution or denial of service. The weakness is identified as CWE‑451.

Google Chrome desktop builds on the stable channel released prior to version 150.0.7871.47 are vulnerable. Users who have not updated to the patched build are at risk, including all desktop deployments of the stable channel older than this build.

The CVSS score of 6.5 indicates medium severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a malicious HTML page delivered to the victim and relies on user interaction; no privilege escalation or credential compromise is needed. The likely attack vector is remote via a malicious web page, and the flaw is associated with CWE‑451.