A flaw in the FileSystem UI in Google Chrome lets a remote attacker craft a malicious HTML page that manipulates how certain UI elements are displayed, enabling the attacker to spoof file prompts or other interface components. This counterfeiting can mislead users into performing actions they would otherwise avoid, such as granting file access or executing unwanted commands. The weakness is catalogued as CWE-451, a medium impact defect related to the improper use of UI elements to deceive users.

Google Chrome versions earlier than 154.0.8037.57 are affected. The issue applies to the stable channel and any older releases that did not receive the patch corresponding to the upload noted in the browser release blog.

The vulnerability has a CVSS score of 5.4, indicating medium severity. The EPSS score is not publicly available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation at this time. The attack requires a remote attacker to host a crafted web page that a victim visits; successful social engineering is necessary to lure the user into interacting with the deceptive UI elements. While there are no reported active exploits, the possibility of future use should be considered.