This vulnerability is a missing authorization check in the Chromium Views subsystem on macOS. An attacker who has already compromised the renderer process can serve a malicious HTML page that overlays spoofed user‑interface elements, creating a false impression that may be used for social engineering. The weakness is identified as CWE‑862, improper authorization control.

Affected products are Google Chrome on macOS, specifically all releases earlier than version 154.0.8037.57. No other vendor or platform combinations are reported as impacted.

The CVSS score of 5.4 indicates medium severity, and no EPSS data is available. The vulnerability is not listed in CISA KEV. Exploitation requires initial compromise of the renderer process, making it less likely for remote attackers to launch the attack directly; once the renderer is compromised, the attacker can deliver a crafted page that deceives the user through spoofed UI elements. The impact is primarily deception and social engineering rather than code execution or system compromise.