Incorrect authorization in HTML in Google Chrome prior to 156.0.8078.47 permits a remote attacker, using a specially crafted HTML page, to bypass the browser's web origin policy. This flaw allows an attacker to access resources from origins that should otherwise be inaccessible, potentially compromising confidentiality and integrity of data loaded in the browser. It is a type of CWE‑863: Incorrect Authorization and poses a remote, content-based attack risk.

Any installation of Google Chrome with a version earlier than 156.0.8078.47 is vulnerable. Users of the stable channel before this release need to update, as the affected builds include the rendering engine that is susceptible to the incorrect authorization flaw.

With a CVSS score of 8.8, the vulnerability is considered high severity. The EPSS score shows a probability of less than 1%, and it is not listed in CISA’s KEV catalog, suggesting no widespread exploitation at the time of this analysis. The likely attack vector is a malicious HTML page served over the network, indicating that exposure through browsers poses a significant risk. An attacker who succeeds could bypass the browser’s origin restrictions, enabling unauthorized interaction with other web origins and potentially serving as a foothold for further attacks.