A vulnerability in the Chromoting component of Google Chrome allows a remote attacker to send crafted network traffic that causes the browser to display user interface elements that do not correspond to the actual state of the remote session. The flaw can mislead users into believing they are interacting with legitimate application components, potentially leading to accidental disclosure of credentials or sensitive data through social engineering. The weakness is classified as CWE-451, indicating information exposure through a deceptive channel.

Affected systems include Google Chrome Chromoting clients running any version prior to 154.0.8037.57. The issue exists in the stable channel releases that have not yet incorporated the patch, affecting desktop users of Chrome on Windows, macOS, and Linux.

The CVSS score is 4.8, representing a medium severity. EPSS data is not available, so the likelihood of exploitation cannot be quantified, and the vulnerability is not listed in CISA’s KEV catalog. The attacker’s likely vector is remote network traffic to a Chromoting session, requiring packet injection or modification on that path. No local privilege escalation or code execution is possible.