The vulnerability stems from missing authorization in Chrome's passwords feature before version 156.0.8078.47, allowing a remote attacker who has compromised the renderer process to employ social engineering and a crafted HTML page to spoof UI elements. This flaw enables the attacker to manipulate the browser's behavior, potentially enabling malicious actions such as credential theft or arbitrary code execution within the renderer.

Google Chrome versions prior to 156.0.8078.47 for desktop platforms are vulnerable. The affected product is Chrome across all operating systems that run a version older than the specified security update. Users of any OS that hosts the vulnerable Chrome version should be aware of this risk.

With a CVSS score of 9.6, the flaw is rated as critical. The EPSS score of < 1% indicates that exploitation is unlikely but not impossible; the lack of listing in the CISA KEV catalog suggests that a widespread exploitation campaign has not yet been documented. The attack can be performed from a remote location by hosting a crafted HTML page and convincing a user to open it. It is inferred that exploitation likelihood remains low if the patch is not applied.