This vulnerability arises from incorrect authorization checks within Chrome’s navigation handling. When a renderer process has been compromised by a remote attacker, the attacker can craft a malicious HTML page that tricks the browser into displaying forged UI elements. The attacker can thus deceive users into interacting with counterfeit controls or gaining information through deceptive prompts, compromising the confidentiality of contextual information and potentially influencing user actions.

Google Chrome browsers prior to version 153.0.8010.36 are affected. The issue exists in all platforms where the Chrome renderer processes run under the default security model.

The flaw has a CVSS score of 4.2, corresponding to Medium severity. The exploit requires an attacker to first gain control of a renderer process, typically through compromising a webpage or leveraging another vulnerability that allows code execution in that process. Once the renderer is compromised, an attacker can deliver crafted content to the user to spoof interface elements. The EPSS score is <1%, indicating a very low exploitation probability, and the issue is not listed in the CISA KEV catalog, suggesting that the threat of widespread exploitation is currently limited, but the potential impact on users is significant if the renderer is compromised.