A flaw in Chrome’s handling of downloaded items allows a remote attacker to create a web page that masquerades as a legitimate download, tricking users into interacting with a spoofed interface. The vulnerability does not enable code execution or arbitrary data disclosure; its primary impact is potential social engineering leading to user misbehavior. The weakness is classified as CWE‑451, indicating improper content typing leading to deceptive output.

Google Chrome versions prior to 145.0.7632.45 on any supported operating system – Windows, macOS, and Linux – are affected. The flaw exists in the browser’s downloads implementation and can be triggered by any victim consuming the crafted page.

The base CVSS score of 4.3 indicates low severity. EPSS is below 1 %, suggesting that exploitation is unlikely at present. Chrome is not listed in CISA’s KEV catalog, so no known widespread exploitation is reported. The most probable attack vector is a remote victim visiting a malicious webpage that induces the spoofed download prompt; it requires no special pre‑conditions beyond the victim’s browser.