The vulnerability in Google Chrome’s Autofill feature on macOS enables a remote attacker who can host a malicious webpage to present counterfeit user interface elements. By embedding crafted HTML, the attacker can mimic the browser’s autofill prompts, potentially deceiving users into revealing sensitive information or performing unintended actions. This flaw does not provide code execution but facilitates phishing‑style attacks by exploiting UI misrepresentation (CWE‑451).

Google Chrome on macOS versions prior to 156.0.8078.47 are impacted. Users running the stable channel of Chrome on macOS should verify their current build and apply the latest update to address the flaw.

With a CVSS score of 8.8, the vulnerability is considered high severity. The EPSS score of < 1% indicates a low but nonzero likelihood of exploitation, and the flaw is not listed in the CISA KEV catalog. An attacker would need the victim to visit a malicious web page that hosts the crafted UI, after which the spoofed Autofill elements can lure the user into submitting data that is then sent to the attacker.