A crafted HTML page can trigger a UI misrepresentation in Chrome’s input handling that causes the browser to display a spoofed address bar, deceiving users into believing they are visiting a different website. The flaw falls under CWE‑451 (Incorrect Assertion) and CWE‑825 (Uncontrolled Resource Consumption), but it does not lead to code execution or direct system compromise. The attack relies on a deceptive visual cue to facilitate phishing or social‑engineering attempts.

The vulnerability affects all releases of Google Chrome that are older than version 156.0.8078.47, regardless of platform, since the issue resides in the Chromium rendering engine shared across desktop builds.

The CVSS score of 8.8 indicates a high severity flaw. The EPSS score of less than 1% shows that public exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a remote attacker to host a crafted HTML page that a user visits; it does not require privileged access or remote code execution. The impact is limited to UI deception, but the attack can be highly effective if users are convinced by the spoofed address bar.