The vulnerability is an incorrect authorization check in the WebAppInstalls feature of Google Chrome. A malicious HTML page can be crafted so that a socially engineered victim opens it and the browser allows the page to invoke WebAppInstalls without the necessary permission checks. This flaw can lead to the disclosure of sensitive information that the page can read from the browser, such as cached credentials or user data, via the WebAppInstalls API. The vulnerability is identified as CWE-863.

Google Chrome versions prior to 156.0.8078.47 are affected. The fix was released in the 156.0.8078.47 update, so any Chrome installation older than this patch is vulnerable regardless of operating system.

The CVSS score of 8.8 indicates a high severity impact, but the EPSS score of less than 1% suggests a very low likelihood of exploitation at this time. The flaw can be exercised remotely through a web page, but only if an attacker successfully lures a user to visit that page, which is why social engineering is crucial to the attack. The vulnerability is not listed in the CISA KEV catalog, and no public exploit is currently known beyond the description of the flaw. Despite the low EPSS, the potential for sensitive data leakage warrants prompt remediation.