Missing authorization in Google Chrome’s Input component, present in all releases before 156.0.8078.47, allows an attacker to craft a malicious HTML page that bypasses the web origin policy. This flaw can be leveraged to read or write data belonging to other origins, potentially leading to data theft or arbitrary script execution. The vulnerability is classed as CWE‑825 and CWE‑862, indicating an authorization bypass and a use‑after‑free vulnerability, respectively.

Google Chrome browsers running versions older than 156.0.8078.47 are affected. The flaw does not impact other Google products or non‑Chrome browsers.

The CVSS score of 8.8 highlights a high severity impact. The EPSS score is less than 1%, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting limited known exploitation at this time. Attackers can exploit the flaw remotely by delivering a crafted HTML page, making the attack vector accessible over the public internet. Given the nature of the missing authorization flaw and the sandbox context, the potential for data theft or arbitrary script execution is significant if the browser processes untrusted content.