A missing authorization check in Chrome’s Transactions Platform permits a remote attacker that has already gained control over the renderer process to construct a specially crafted HTML page capable of imitating legitimate UI elements. The flaw does not allow arbitrary code execution; instead it enables deceptive visual cues that may trick users into interacting with forged controls, potentially leading exploiting trust in the browser interface.

Google Chrome browsers with build numbers older than 153.0.8010.47 are vulnerable. All newer releases are assumed to contain the fix. No other vendors or products are listed as affected, and there is no evidence of cross-product impact beyond Chrome.

The CVSS score of 4.2, and the EPSS score of less than 1 % reflects an extremely low likelihood of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog, which suggests it is not currently known to be actively exploited. Based on the description, it is inferred that the vulnerability does not grant arbitrary code execution and is limited to UI spoofing within the browser. An attacker must first compromise the renderer process, a condition that typically implies prior malicious code execution inside the browser, before the crafted page can be served.