A confused‑deputy flaw was found in the WebAppInstalls feature of Google Chrome versions prior to 156.0.8078.47, allowing a remote attacker to trick the browser into treating an untrusted origin as if it were trusted by serving a specially crafted HTML page. This vulnerability, classified as CWE‑441, bypasses the browser’s same‑origin policy and could enable a malicious website to access data or act on the user’s behalf that would normally be protected by origin boundaries. The flaw carries a CVSS score of 8.8, indicating high severity, and is considered a significant threat if exploited.

The flaw affects all versions of Google Chrome prior to 156.0.8078.47 when the WebAppInstalls feature is enabled.

The CVSS score of 8.8 indicates high severity. The EPSS score of <1% indicates a very low but non‑zero probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, and no public exploits are known. Attackers would need to host a malicious web page that the victim could access; this implies a web‑based attack vector, but whether user interaction is required is inferred from the nature of the flaw. Overall risk remains moderate to high until the patch is applied.