The vulnerability involves UI misrepresentation in Chrome Extensions prior to version 156.0.8078.47, allowing a remote attacker to spoof UI elements through a crafted extension and deceive users into interacting with forged dialogs. Using social engineering, the attacker can trick users into engaging with the spoofed UI, potentially leading to credential disclosure or other malicious actions. The weakness involves improper handling of extension‑provided UI resources, classified as CWE-451 and CWE-825.

Desktop users of Google Chrome, versions preceding 156.0.8078.47, are affected. The flaw is present in the executable code that processes extension‑based content prior to that version and is fixed in Chrome 156.0.8078.47 and later releases.

The CVSS score of 8.8 indicates a high severity, reflecting the potential for widespread social engineering attacks. The EPSS score is <1%, suggesting a low probability of current exploitation, but the vulnerability remains dangerous because any user who installs the malicious extension will be exposed. The attack requires a malicious Chrome extension to be installed, typically via user interaction or click‑through, and can be delivered by a compromised website or a deceptive app distribution channel. The vulnerability is not listed in the CISA KEV catalog, but it still poses a significant risk to users and organizations that rely on Chrome for critical operations.