An incorrect authorization check in the Media module of Google Chrome on Windows allows a remote attacker who has already compromised the renderer process to manipulate or replace user‑interface elements by serving a specifically crafted HTML page. The flaw enables UI spoofing and could mislead users into interacting with fake page controls or buttons, potentially leading to phishing or deceptive behavior. Chromium labels this issue as a low‑severity bug, but the CVSS score remains 8.8, reflecting a high potential impact if the precondition of renderer compromise is met.

Windows users running any Chrome build older than 156.0.8078.47 are affected. The vulnerability is located in the Media component of the browser’s renderer. No other Chrome releases or operating systems besides Windows are documented as vulnerable in the provided data.

The CVSS v3 score of 8.8 places the vulnerability in the high severity range, while the EPSS figure of <1% indicates a very low current exploitation probability. The flaw is not included in CISA’s known exploited vulnerabilities catalog. Exploitation requires the attacker to have already gained control of a renderer process, after which they can use the Media module to alter UI elements. Because the attack vector depends on prior renderer compromise, the overall risk to users is reduced compared to a direct attack from an unprivileged webpage.