Improper access control within the Ozone component of Google Chrome permits a remote attacker to spoof UI elements by delivering a crafted HTML page, allowing deceptive interactions or signalling that can mislead users. The weakness, identified as CWE-451, enables the attacker to render falsified content in place of genuine browser elements. This manipulation can lead to user confusion or other unintended actions when the malicious page is viewed.

Google Chrome browsers prior to version 156.0.8078.47 are affected. Any installation of Chrome that has not been updated to this version or later is vulnerable.

The vulnerability is rated medium in Chromium security severity, reflected by a CVSS score of 6.5. The EPSS score is less than 1%, and the issue is not listed in the CISA KEV catalog. The attack vector is remote, requiring an attacker to host or embed a malicious HTML page accessible to the victim’s browser. No additional exploitation prerequisites are documented, indicating that simply opening the crafted page could trigger the UI spoofing effect.