An injection flaw in Chrome's DevTools permits a specially crafted HTML page to manipulate the browser’s UI. The weakness, identified as CWE‑74, allows an attacker to spoof interface elements, potentially misleading a user into interacting with deceptive prompts. The description does not indicate the flaw escalates beyond UI manipulation, and no evidence of sandbox escape or privilege escalation is documented.

Google Chrome releases prior to version 156.0.8078.47 across stable, beta, and dev channels are affected. Users of version 155.x or earlier are vulnerable, as identified by the Chromium internal issue tracker entry 513686739.

With a CVSS score of 8.8, the vulnerability is considered high impact. The EPSS score of less than 1 % suggests a very low but nonzero exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack would involve a social‑engineering scenario where a victim opens a malicious HTML page while DevTools is active, causing UI spoofing via the injection flaw. Because the exploit operates within the browser process with sandboxed privileges, it does not currently provide remote code execution or system‑wide compromise.