Chromium currently contains a UI misrepresentation flaw that allows a remote attacker to spoof browser interface elements through a crafted web page. Because the attacker can modify how UI components are displayed, users can be misled into interacting with malicious input fields or buttons that appear to be part of the legitimate Chrome interface. This vulnerability falls under CWE‑451 and can be used only to mislead users, not to execute arbitrary code.

Google Chrome for desktop on the stable channel prior to version 154.0.8037.57 is affected. Any installation of Chrome that has not been updated to 154.0.8037.57 or later carries the risk. The issue does not affect other Chromium‑based browsers unless they share this code path.

The CVSS score of 5.4 rates this as a medium risk vulnerability. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. An attacker would need to entice a user to visit a malicious page that contains the crafted UI elements; the attack vector is therefore primarily phishing or social engineering. There is no known path to remote code execution or direct data exfiltration, but the deceptive UI can lead to credential theft or other user‑initiated compromise.