This vulnerability is an improper authorization flaw (CWE-863) arising from CSS parsing in Google Chrome. A crafted CSS can cause the browser to bypass its web origin policy, allowing a remote attacker to access information across domains. This results in confidentiality compromise of data that would normally be protected by the same‑origin restriction.

All Chrome Desktop releases older than 156.0.8078.47, including every prior stable channel version, are affected. The bug is present in the rendering engine that processes CSS styles supplied by web content.

With a CVSS score of 6.5 and an EPSS score of < 1%, the vulnerability carries a moderate risk level. The flaw is remote and requires a crafted HTML page to trigger the incorrect authorization during CSS parsing that bypasses the web origin policy. It is not listed in CISA’s KEV catalog, and based on the description, it is inferred that no publicly available exploit is known, which keeps the likelihood of widespread exploitation moderate. Browsers that have not yet applied the 156.0.8078.47 update remain vulnerable.