Missing authorization in BrowserTag in Google Chrome permits a remote attacker who has already gained control of the renderer process to leak cross‑origin data by loading a malicious HTML page. The flaw allows the attacker to read memory that should be isolated to a different origin, potentially exposing sensitive information. This type of violation is classified as an authorization bypass.

All installations of Google Chrome on supported platforms running a version older than 156.0.8078.47 are affected. The vulnerability is tied to the Chrome product identified by the CNA. No later releases include the fix.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% reflects a low likelihood of successful exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Exploitation requires the attacker to compromise the renderer process and serve a crafted HTML page to the victim; beyond this, the vulnerability does not provide a direct remote code execution path.