The flaw in Chrome’s permission UI misrepresents the origin domain shown to users, allowing a crafted web page to display an unrelated domain name. This can deceive users into granting permissions or engaging with malicious content under the guise of a trusted site, resulting in phishing or credential theft. The vulnerability is recognized by CWE-1021 and CWE-451, indicating incorrect permission handling and UI misrepresentation.

Affected users are on Microsoft Windows running any Chrome build before version 147.0.7727.55. The CVE applies to the stable channel of Google Chrome and does not affect other operating systems or Chrome releases beyond the specified version.

The CVSS v3.1 score of 6.5 classifies it as medium severity. The EPSS score is below 1 percent, suggesting a low probability of exploitation at present. It is not listed in the CISA KEV catalog. A remote attacker can exploit the flaw by hosting a malicious HTML page; the attack requires the victim to visit the page and rely on the incorrect UI display to perform domain spoofing. Users should anticipate potential phishing attempts until the vulnerability is patched.