Google Chrome’s Chromoting feature has a UI misrepresentation flaw allowing a remote attacker to spoof interface elements by sending crafted traffic. This flaw could mislead users into interacting with a counterfeit dialog, potentially leading to credential disclosure or other social‑engineering attacks. The weakness is classified as CWE-451: Incorrect Handling of User Interface Elements, which may compromise confidentiality if users provide sensitive information to a malicious interface.

The affected product is Google Chrome. Versions prior to 154.0.8037.57 of the Chromoting component are vulnerable. Users running Chrome on any platform with an older Chromoting implementation are at risk.

The CVSS score of 4.8 marks the vulnerability as low impact. No EPSS score is available, and it is not listed in the CISA KEV catalog. Exploitation requires the attacker to inject specialized network packets that the victim’s Chrome processes, so a user must be connected to a remote session or otherwise open a channel that can be manipulated. The attack vector is therefore network‑based, and while the likelihood of widespread exploitation is modest, social‑engineering success can still have serious consequences if a user follows a spoofed prompt.