The vulnerability is a UI misrepresentation flaw in Google Chrome’s WebAppInstalls component. Prior to version 156.0.8078.47, a remote attacker can supply a carefully crafted HTML page that allows the browser to display a spoofed address bar, making the user believe they are visiting a legitimate site. This manipulation falls under CWE‑451 and could lead to users unwittingly submitting sensitive information or interacting with malicious content.

Google Chrome desktop users running a version older than 156.0.8078.47 are affected. The issue exists in the stable channel before that revision and applies to all operating systems; the WebAppInstalls feature is enabled by default in standard Chrome builds.

The CVSS score of 9.6 indicates a severe risk level. The EPSS score of < 1 % suggests that exploitation is currently unlikely, but the high severity warrants prompt action. The likely attack vector involves delivery of a crafted HTML page, such as via a malicious website or a phishing email that opens a local file. The flaw can be triggered from a regular user context without requiring sandbox escape as described in the official CVE description.