Clickjacking in Chromoting is found in Google Chrome versions before 156.0.8078.47. It allows a remote attacker to leverage social engineering and crafted network traffic to spoof user interface elements during a Chromoting session. The flaw is a UI redirection weakness identified as CWE-1021, enabling an attacker to display deceptive UI components that may trick a user into interacting with them, undermining trust in the browser interface.

Google Chrome versions earlier than 156.0.8078.47 on all platforms are affected. The vulnerability is tied to the Chromoting feature, which is used when a user accesses remote desktop sessions through Chrome.

The CVSS score of 8.8 indicates a high severity, while the EPSS score of < 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires a remote attacker to deliver crafted network traffic that triggers clickjacking within a Chromoting session, resulting in UI spoofing that can lead to user misinformation.