The vulnerability arises from an inappropriate implementation in the file input component of Google Chrome, allowing a remote attacker who persuades a user to perform specific UI gestures to execute UI spoofing via a crafted HTML page. The attacker can trick the user into interacting with UI elements that appear legitimate, potentially leading to phishing or social engineering attacks. The impact is concentrated on the user session, enabling manipulation of the user interface but does not by itself provide direct code execution or data exfiltration.

Google Chrome versions earlier than 145.0.7632.45 on Windows, macOS, and Linux environments are affected. The vulnerability does not limit itself to a particular operating system, as the impacted component is cross‑platform.

The CVSS score is 5.4, indicating low severity. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of widespread exploitation. An attacker must rely on social engineering to convince a user to engage in specific UI gestures on a crafted web page. The exploit requires the user’s interaction and is thus considered user‑dependent, making it less likely to be automated but still viable in targeted phishing campaigns.