The vulnerability is a UI misrepresentation flaw that allows a remote attacker to craft a malicious HTML page capable of spoofing UI elements displayed by the browser. While the official name suggests a remote code execution possibility through improper input validation, the core impact described is the ability to trick users with fake prompts and controls, potentially leading to credential theft or other social‑engineering attacks. The weakness falls under improper input validation, identified as CWE-451.

It exists in all versions of Google Chrome released before 156.0.8078.47, regardless of operating system. Users still running earlier releases are exposed to the flaw.

The CVSS score of 8.8 indicates a high severity risk, while the EPSS score of < 1% shows a very low but nonzero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a maliciously crafted HTML page that a user visits, which triggers the UI spoofing behavior. No publicly known exploits were reported at the time of this analysis.