Chrome navigation contains a use‑after‑free vulnerability that allows a remote attacker to spoof UI elements via a crafted HTML page, but only after the renderer process has been compromised. The flaw is a memory safety error, classified as CWE‑672 and CWE‑825. The vulnerability has a CVSS score of 8.8, indicating high severity. The Chromium project rates it as medium severity, but the ability to spoof UI can lead to deceptive attacks on users.

All Google Chrome desktop users running a version earlier than 156.0.8078.47 of the stable channel are affected. The vulnerability exists in the Navigation module and applies to any browser session that loads malicious web content via that module.

Because the flaw can be triggered by a malicious HTML page only when the renderer process has been compromised, the attack vector is remote web content. The exploitation path requires the victim to open a malicious HTML page in Chrome after the renderer process has been compromised; once triggered, the attacker can spoof UI elements. The EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog, so the overall exposure depends largely on the attacker’s ability to lure users to malicious sites. However, the high CVSS score signifies serious risk if the flaw is exploited.