A UI misrepresentation flaw in Chrome’s Internals on macOS, introduced before version 156.0.8078.47, lets a remote attacker spoof UI elements by serving a crafted HTML page. The flaw is characterized by its medium security severity as noted by Chromium, and can be used to mislead users into interacting with malicious content by making the interface appear legitimate.

The vulnerability affects Google Chrome for macOS versions prior to 156.0.8078.47. Users running any earlier stable channel build are vulnerable until a patched build is deployed.

The CVSS score of 8.8 classifies this flaw as high severity, but the EPSS score is below 1%, suggesting that exploitation is currently uncommon. It is not yet listed in the CISA KEV catalog. The likely attack vector is remote: an attacker delivers a malicious HTML page or injects content into a web page that the victim loads. Successful exploitation would result in UI spoofing that can trick a user into performing actions they did not intend, compromising trust and potentially enabling further social‑engineering attacks.