The flaw is caused by improper input validation in the Core component of Google Chrome before version 156.0.8078.47. If an attacker has already compromised the renderer process, they can supply a specially crafted HTML page that will spoof UI elements. While the vulnerability itself does not expose direct code execution, the resulting deceptive UI can be leveraged for phishing or other attacks. The weakness is classified as CWE-20.

Affected systems are all users running Google Chrome versions earlier than 156.0.8078.47 on any supported operating system, including Windows, macOS, and Linux. The CVE does not distinguish between release channels, so stable, beta, dev, and canary builds prior to the patch are vulnerable.

With a CVSS score of 9.6, the vulnerability poses a severe risk. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not included in the CISA KEV catalog. Attackers would need to compromise the renderer process first, then deliver a malicious HTML page—typically through a compromised website or email attachment—to exploit the input validation flaw and spoof the user interface.