UI misrepresentation in Google Chrome's password handling system before 156.0.8078.47 allows an attacker to spoof UI elements with a crafted HTML page. This flaw is a CWE-451 weakness. The misrepresentation could be used to trick users into submitting credentials to fake forms or otherwise enable credential theft, representing a risk to confidentiality and potentially facilitating further compromise, but does not directly grant arbitrary code execution.

All desktop installations of Google Chrome with a version earlier than 156.0.8078.47 are affected, as inferred from the description, regardless of operating system.

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score of < 1% indicates a very low exploitation probability, and it is not listed in CISA KEV, suggesting no widespread exploitation yet. The likely attack vector is a malicious HTML page that a user could visit or load, which may be combined with social engineering to trick users into viewing the page.