The vulnerability is an inappropriate implementation in the Core component of Google Chrome before build 156.0.8078.47. A remote attacker who has already compromised the renderer process can spoof user interface elements through a crafted HTML page, leveraging social engineering. This use‑after‑free flaw allows the attacker to execute arbitrary code within the sandboxed renderer, undermining the integrity of the browsing session. (Chromium security severity: Medium)

Any installed instance of Google Chrome on desktop platforms that predates version 156.0.8078.47 is affected. The Core component of the browser, which includes rendering and JavaScript execution, contains the flaw.

The CVSS score of 8.8 indicates high severity. The EPSS score is below 1% and the issue is not listed in the CISA KEV catalog, suggesting limited current exploitation in the wild, but the vulnerability can be triggered remotely simply by opening a malicious HTML page. Once exploited, the attacker gains the privileges of the sandboxed renderer, potentially altering page content or facilitating further compromise within the browser context.