UI misrepresentation in Bluetooth in Google Chrome prior to version 156.0.8078.47 allows an adjacent attacker to spoof UI elements by using a malicious peripheral. By presenting a counterfeit interface, the attacker can socially engineer an adjacent user into interacting with it, enabling the attacker to run code at the browser process level and potentially compromise the user's system.

Google Chrome versions prior to 156.0.8078.47 are affected. The issue appears in the desktop channel and applies to all operating systems that use this Chrome build.

The vulnerability has a CVSS score of 8.8, indicating high severity, but its EPSS score is <1%, indicating a very low probability of exploitation. The flaw is not listed in the CISA KEV catalog. The likely attack vector is an adjacent attacker deploying a malicious Bluetooth peripheral that spoofs UI elements; the victim must interact with the counterfeit UI for the exploit to trigger. Once triggered, the attacker can execute code with sandbox privileges, potentially allowing privilege escalation or data exfiltration if combined with other weaknesses.