An incorrect authorization check in PDFium enabled an attacker to bypass Chrome’s web origin policy when a user opened a crafted PDF file. The flaw is triggered by a malicious PDF that tricks the PDFium parser, allowing the content to run with the privileges of the Chrome process. Because the PDF is processed within the browser sandbox, successful exploitation could lead to arbitrary code execution or unauthorized access to the user’s system.

Google Chrome versions earlier than 156.0.8078.47 are affected. This includes all builds prior to the stable release 156.0.8078.47, regardless of the operating system or update channel.

With a CVSS score of 8.8, the flaw is rated high severity, and the EPSS score of <1% indicates that exploitation is currently unlikely. It is not listed in the CISA KEV catalog, suggesting no widespread use. Attackers could embed a crafted PDF in an email, online download, or malicious web page, prompting a user to open it in Chrome before the patch is applied. Successful exploitation could let an attacker bypass Chrome's web origin policy and execute arbitrary code or access protected resources, dramatically increasing the risk for any unpatched user.