According to the updated description, the vulnerability involves UI misrepresentation in Chrome’s WebAppInstalls feature that can be exploited by a remote attacker to spoof the address bar of a newly installed Chrome application via a crafted extension. By displaying a fraudulent site location, the attacker can deceive users into believing they are interacting with a legitimate web page, which may be used for phishing or credential harvesting. The vulnerability is categorized as CWE-451, which involves bypassing the intended UI display to mislead users. Although Chromium ranks the overall severity as low, the CVSS score of 8.8 reflects the significant potential impact from such deceptive attacks, especially when combined with social engineering tactics.

All users running Google Chrome on desktop who have not yet updated past version 156.0.8078.47, including those on the stable channel. The update referenced in Google’s release notes brings the WebAppInstalls feature to a safe state.

EPSS <1% indicates a very low likelihood of exploitation, and the CVE is not listed in CISA's KEV catalog, suggesting no widespread attacks have been observed to date. The CVSS score of 8.8 recognises high risk due to the potential for significant damage if exploited, especially given the social engineering nature of the attack. Exploitation requires a user to install or enable a malicious Chrome extension that performs the spoofing; without user interaction, the vulnerability cannot be leveraged.