A UI misrepresentation vulnerability exists in the WindowControlsOverlay component of Google Chrome versions prior to 156.0.8078.47. When a malicious web page is displayed, the vulnerability can be triggered to allow an attacker to spoof interface elements, creating deceptive UI that may trick users into engaging with malicious actions. The flaw is exercised by serving a specially crafted HTML page; the browser renders overlay components that can be manipulated to appear as legitimate controls. The primary consequence is that an attacker could use this to facilitate phishing or social‑engineering attacks by impersonating native UI elements, resulting in potential credential theft or other malicious activity. The vulnerability's impact is limited to UI deception; there is no direct code execution or system compromise, but the resulting social‑engineering can be highly damaging.

The flaw exists in all editions of Google Chrome prior to version 156.0.8078.47. Any user running a superseded release on supported operating systems is at risk. The attack requires the victim to visit a malicious web page in the affected browser, so the risk applies to anyone who enables standard browsing.

The flaw carries a CVSS score of 8.8, indicating high severity. The EPSS score of less than 1% indicates a very low, but non‑zero, probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the vulnerability is remotely exploitable via the normal web‑content delivery channel, making it a prime target for attackers who can host malicious sites or drive users to compromised URLs. Users should act promptly to mitigate this high‑impact risk.