The FullScreen handling of Google Chrome prior to 156.0.8078.47 enables a remote attacker to spoof the address bar via a crafted HTML page, causing UI misrepresentation. This flaw falls under CWE-451 and can mislead users into trusting malicious content.

Affected systems include the Google Chrome browser on desktop platforms. Versions earlier than 156.0.8078.47 are vulnerable. The issue is specific to the FullScreen handling code in Chrome's renderer process and impacts all operating systems that install the default Chrome browser with full-screen capabilities, including Windows, macOS, and Linux.

The vulnerability is rated CVSS 8.8, indicating a high severity level. EPSS is less than 1%, and it is not listed in the CISA KEV catalog, but the high CVSS score signals significant potential impact. The likely attack vector is a remote attacker serving a malicious web page that requests full-screen mode; by exploiting the UI spoofing flaw, the attacker can mislead users into interacting with malicious content, potentially leading to phishing or credential theft. This could be leveraged for further social engineering or malware distribution.