UI misrepresentation in Chrome’s Passwords component allows a remote attacker to spoof the password prompt with a crafted HTML page, enabling social engineering that can lead to credential theft. The vulnerability does not provide arbitrary code execution; it deceives users into entering passwords into a fake interface. The resulting impact is the compromise of user credentials and the integrity of authentication data.

Google Chrome versions older than 156.0.8078.47 on Windows, macOS, and Linux are vulnerable. The vendor’s CPE indicates that any build of Chrome before the patched release can be affected, regardless of the operating system.

The CVSS score of 8.8 reflects high severity, while the EPSS score of less than 1% indicates a low likelihood of observed exploitation. This vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remote attacker delivering a malicious HTML page that triggers the UI misrepresentation in the Passwords component; this is inferred from the description, as the text does not explicitly name the vector. An attacker must entice a user to interact with the spoofed UI, so the risk is limited to victims who visit the compromising page. The consequence is primarily the theft of credentials and the potential for persistent phishing attacks.