The vulnerability description has been updated. The defect stems from an incorrect reference resolution within the FileSystem subsystem of Google Chrome versions prior to 156.0.8078.47. A remote attacker who has already compromised the renderer process and can influence the user through social‑engineering can supply a specially crafted HTML page that exploits the flaw, causing JavaScript or other code to execute outside the renderer sandbox. The vulnerability, classified as CWE-706, may allow execution of attacker‑controlled code beyond the sandbox boundaries, potentially enabling full compromise of the system, while a sandbox escape remains an additional step for the attacker.

Google Chrome versions older than 156.0.8078.47 on any supported desktop platform are affected. The CVE does not list specific OS variants, but the issue exists in all builds of the stable channel prior to the mentioned version.

The CVSS score of 8.8 places this flaw in the high‑severity range, indicating significant potential for confidentiality, integrity, and availability impact. EPSS <1% suggests a low probability of exploitation at present, but the lack of a KEV listing does not mitigate the inherent threat. The likely attack vector involves a malicious web page delivered over the network that a user accesses in Chrome; an attacker must first gain renderer process compromise, typically via social engineering or other initial intrusion techniques, to trigger the exploitation.