The vulnerability, described as a missing authorization in Chrome's API before 156.0.8078.47, allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox through a crafted HTML page. The flaw involves an out‑of‑bounds read (CWE-125) coupled with a lack of proper permission checks (CWE-862), potentially exposing memory contents or bypassing the browser's sandbox. Chromium rates the security severity as medium, but the ability to escape the sandbox represents a higher impact than a simple memory disclosure.

The vulnerability affects Google Chrome versions earlier than 156.0.8078.47. Users who have not installed the stable channel update with version 156.0.8078.47 or later are impacted. All installations of these older releases are susceptible.

The CVSS score of 6.5 and EPSS < 1% indicate a medium severity and low exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog, showing no confirmed active exploit. Exploitation requires a remote attacker capable of serving a malicious HTML page *and* having already compromised the renderer process, after which arbitrary code could run outside the sandbox. Due to the dual prerequisites and low exploitation probability, the overall risk remains low but non‑zero for users running vulnerable Chrome versions.