Incorrect authorization in Workers in Google Chrome prior to version 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) The weakness, classified as CWE‑863, could let an attacker access or manipulate resources from other origins that should be protected, potentially enabling data theft or execution of malicious code within the browser context.

Google Chrome versions earlier than 156.0.8078.47 are affected. The vulnerability applies to the stable channel and any installations that have not yet received the update referenced in the Chromium issue tracker. The patch is included in Chrome version 156.0.8078.47 and later.

CVSS score of 8.8 indicates high severity. EPSS score of <1% suggests low likelihood of exploitation, though the vulnerability is not listed in CISA KEV. The attack vector is remote and requires a crafted HTML page, so it can be triggered by a malicious website or script loaded in a tab. Given the high CVSS, organizations should treat this as high risk until the patch is applied.