Improper input validation in the Core component of Google Chrome prior to 156.0.8078.47 allows a remote attacker that has compromised the renderer process to spoof UI elements via a crafted HTML page. The flaw is triggered when the page is rendered, letting malicious content masquerade as legitimate browser interface elements. Consequently, an attacker can deceive users or facilitate phishing interactions.

Google Chrome browsers running on desktop platforms with a version earlier than 156.0.8078.47 are vulnerable. This includes all stable channel releases prior to the update published on October 2, 2026. The vulnerability affects Windows, macOS, and Linux distributions where the Chrome runtime includes the affected Core library.

The CVSS base score of 8.8 indicates a high severity risk. The EPSS score is less than 1%, which indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, meaning no confirmed active exploits have been observed. The attack vector is remote, requiring the user to open a malicious webpage or download a compromised file that renders the page.