The flaw is an internal authorization weakness in a Chrome API that can be triggered by a crafted HTML page, allowing a remote attacker to bypass system access controls and potentially perform privileged operations within the browser context. This is a CWE‑863 vulnerability.

Any desktop installation of Google Chrome older than version 156.0.8078.47, across Windows, macOS, and Linux, is affected. The vulnerability was identified in the stable channel and impacts any instance that renders user‑supplied web content that loads the vulnerable API. The CVE document does not explicitly list operating systems, so it is inferred that, as a desktop browser, the impact spans typical desktop OSes such as Windows, macOS, and Linux.

It carries a CVSS score of 8.8, indicating a high severity. The EPSS score of < 1% suggests low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. A remote attacker can exploit the flaw by serving a malicious HTML page that triggers the vulnerable API, so browsing untrusted sites is a potential attack vector. While the CVE description does not expressly state the attack vector, it is inferred that the flaw can be triggered when a user visits a malicious site that serves a crafted HTML page.