The vulnerability is a UI misrepresentation flaw in the Model component of Google Chrome. A remote attacker can supply a crafted HTML page that exploits social engineering to spoof UI elements, tricking users into interacting with malicious content. This can lead to phishing attacks within the browser, potentially enabling credential theft or other malicious interactions within the normal browser sandbox.

All Google Chrome desktop releases prior to version 156.0.8078.47 on Windows, macOS, and Linux are impacted.

The CVSS score of 8.8 indicates high severity. EPSS data is below 1%, and the vulnerability is not listed in CISA’s KEV catalog. This UI misrepresentation flaw in Chrome’s Model component allows a remote attacker to spoof UI elements via a crafted HTML page, typically delivered through phishing or compromised sites. Through social engineering the attacker can trick users into interacting with malicious content, potentially facilitating credential theft or other malicious actions within the normal browser sandbox.