Chromoting in Google Chrome prior to version 156.0.8078.47 contains a UI misrepresentation flaw that allows a remote attacker to send specially crafted network traffic to mimic legitimate interface elements. If a victim interacts with these spoofed elements, the attacker may be able to trick Chrome into executing arbitrary code within the browser's sandboxed environment. The vulnerability is classified by CWE‑451, indicating that incorrect or incomplete information may be used during program execution.

The flaw affects all installations of Google Chrome that include the Chromoting feature and run with a version earlier than 156.0.8078.47, irrespective of operating system. Any user who has not upgraded past this release is potentially exposed.

The CVSS score of 8.8 positions this issue in the high‑severity range, while the EPSS score of <1% indicates that, so far, active exploitation appears uncommon. The vulnerability is not listed in the CISA KEV catalog, but the high CVSS suggests that a determined attacker could gain code execution if they manage to deliver the crafted traffic and persuade a user to interact with the spoofed UI. The nominally low EPSS means that attacks are unlikely unless an active exploitation attempt emerges.