The vulnerability is an incorrect authorization flaw in Google Chrome’s Autofill component that allows a remote attacker who has compromised the renderer process to spoof user interface elements using a crafted HTML page. Leveraging social engineering, the attacker can trick users into interacting with fake form fields, potentially leading to credential disclosure or phishing. The Chromium security severity is Medium.

Google Chrome releases earlier than version 156.0.8078.47 are affected. The issue is present in the stable channel prior to the public update referenced on the Chromium release blog and is remedied in any release at version 156.0.8078.47 or later.

This bug can be triggered by a malicious web page that the user visits. The attacker must be able to inject content that is rendered by the browser’s renderer process, which is typically a normal user session. Once triggered, the attacker can manipulate or replace UI elements, but the vulnerability does not allow arbitrary code execution. Although the EPSS score is <1% and the vulnerability is not listed in CISA’s KEV catalog, the potential for social engineering and phishing makes it a risk worth addressing. The CVSS score of 6.5 reflects medium severity.