An improper state validation bug in the Core component of Google Chrome allows a remote attacker to spoof UI elements by delivering a specially crafted HTML page. The flaw can deceive users into interacting with counterfeit dialog boxes or prompts, though it does not grant arbitrary code execution. It corresponds to an improper access control weakness (CWE-754) and carries a CVSS score of 8.8, indicating high severity, while Chromium internally rated it as low severity.

All users running any Google Chrome version earlier than 156.0.8078.47 on any operating system are affected. Because the defect resides in the Core library, the vulnerability can be triggered from any website loaded in the browser, meaning every site visited by an affected client has the potential to exploit the flaw.

With a CVSS score of 8.8 the vulnerability is considered high severity. However, the EPSS score is reported as less than 1%, indicating a very low probability of public exploitation, and it is not listed in the CISA KEV catalog. The attack vector is remote: an adversary must entice a user to view a crafted web page that contains maliciously structured HTML. No authentication or elevated privileges are required on the host, making social engineering a high‑risk scenario.