The CVE-2026-113206 vulnerability manifests as a UI misrepresentation flaw in the Omnibox component of Google Chrome for all desktop platforms before version 156.0.8078.47. By serving a specially crafted HTML page, an attacker can induce the browser to display fabricated UI elements that appear to be legitimate controls. This deception can mislead users into interacting with elements that were not actually part of the browser’s interface. The weakness is categorized as a UI manipulation issue (CWE‑451).

All Google Chrome browsers installed on Windows, macOS, or Linux that are running a release earlier than 156.0.8078.47 are affected. The security patch shipped in the stable channel update released by Google in October 2026 addresses the underlying memory corruption that permits the spoofing, and it applies to every desktop edition of Chrome.

The CVSS score of 8.8 signals a high severity level, while the EPSS score of less than 1% indicates a low probability that the vulnerability is being actively exploited at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is that a remote attacker convinces a victim to view a crafted web page or visits a malicious site, a scenario inferred from the description.