The updated description highlights a missing authorization flaw in the Input Method Editor (IME) component of Google Chrome before version 156.0.8078.47. It allows a remote attacker who has compromised the renderer process to bypass site isolation via a crafted HTML page, potentially leading to privilege escalation or code execution within the browser sandbox. The weakness corresponds to CWE‑862 (Missing Authorization).

Affected vendor: Google, product: Chrome. Devices running the stable channel of Google Chrome with versions earlier than 156.0.8078.47 are vulnerable. No further version details are provided.

The CVSS score of 8.8 indicates high severity for this vulnerability. The EPSS score is now noted as < 1 %, indicating a very low but non‑zero likelihood that it will be exploited in the wild. The weakness is a missing authorization flaw (CWE‑862) that allows an attacker to bypass site isolation once they have compromised the renderer process. The likely attack vector is a malicious website that the user visits, delivering a specially crafted HTML page that exploits this flaw. The attack is remote but depends on the user rendering the page and the attacker having already compromised the renderer process. The vulnerability is not listed in the CISA KEV catalog, so no known exploitation context is reported.