The vulnerability is an incorrect‑authorization flaw in Google Chrome’s Workers implementation on versions older than 156.0.8078.47. It allows an attacker who can load a specially crafted HTML page and has compromised the renderer process to bypass the browser’s web‑origin policy. Because the origin guard is bypassed, the attacker can execute scripts with elevated privileges, potentially leading to arbitrary code execution or other malicious activity inside the browser. This weakness is classified as CWE‑863, reflecting an Improper Authority Bypass.

Google Chrome desktop releases on Windows, macOS, and Linux that are older than 156.0.8078.47, as well as any Chromium‑based browsers that include the unpatched code base.

The CVSS score of 8.8 conveys high severity, yet the EPSS score is community‑reported as <1% and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote, originating from a maliciously crafted HTML page that a victim unknowingly opens. An attacker having access to the renderer process can use the incorrect‑authorization flaw to bypass the browser’s origin enforcement, allowing the execution of arbitrary scripts with the privileges of the user. This could result in remote code execution or the compromise of other browser processes. Although the attack requires user interaction or control of the renderer, the low EPSS indicates that exploitation is currently limited but should be considered a priority.