The vulnerability is an incorrect authorization flaw in the Chrome Loader component that can be triggered by a crafted HTML page. The flaw allows a remote attacker to bypass Chrome’s web origin policy, potentially enabling access to resources or data from other origins that should be isolated.

Affected users are those running Google Chrome versions prior to 156.0.8078.47 on any platform supported by Google. The issue was addressed in the 156.0.8078.47 release, which contains the necessary fix to the Loader functionality.

The vulnerability received a CVSS score of 8.8, indicating high severity. The EPSS score is < 1%, suggesting a low probability of exploitation, and it is not listed in the CISA KEV catalog, indicating no known exploits at the time of reporting. Attackers can exploit the flaw by delivering a malicious HTML file or opening a compromised web page, gaining the ability to bypass origin restrictions and potentially read or manipulate data from other sites.