The vulnerability in Google Chrome extensions before 156.0.8078.47 enables a remote attacker to spoof UI elements via a crafted extension. This UI misrepresentation can trick users into providing credentials or interacting with malicious controls. The flaw is identified as CWE‑451. Chromium security severity is Medium.

All users running Google Chrome versions earlier than 156.0.8078.47 are affected. Based on the description, the flaw exists in any build that incorporates the vulnerable extension engine, regardless of platform or release channel.

The CVSS score of 8.8 places the vulnerability in the high severity range. Since the EPSS score is < 1%, the exploitation likelihood is very low. The likely attack vector is installing a specially crafted Chrome extension, which a remote attacker can supply. Any user who loads such an extension while running a vulnerable build is at risk. There is no reported public exploit, and the vulnerability is not listed in the CISA KEV catalog.