This vulnerability is a UI misrepresentation flaw in Chrome's PermissionElement that permits a remote attacker to trick a user into interacting with a fake permission dialog presented by a malicious web page. By manipulating the rendered UI, the attacker can create a social engineering attack that mimics legitimate Chrome prompts, potentially leading to user disclosure of sensitive permissions or unwarranted actions. The flaw is classified as CWE‑451 and, as described, does not grant code execution or direct system compromise.

Google Chrome versions earlier than 152.0.7977.65 are affected. The fix applies to any build of Chrome before this release, regardless of operating system.

The vulnerability has a CVSS score of 4.3, indicating low severity, and it requires the user to open a crafted web page to be exploited; an attacker must first lure a victim to a malicious site. The EPSS score is below 1% (approximately 0.17%), indicating a low probability of exploitation, and the issue is not listed in the CISA KEV catalog. Consequently, while the attack vector is remote via the browser, the exploitation probability is low and the impact remains limited to potential phishing rather than system compromise.