A missing authorization flaw exists in Chrome’s WebUI component that allows a remote attacker who has compromised the renderer process to bypass site isolation by serving a crafted HTML page. The vulnerability enables arbitrary code execution with the same privileges as the Chrome process, which can compromise the device and user data. The weakness is classified as CWE-862, a missing authorization error.

Google Chrome is the only affected product listed. Versions prior to 156.0.8078.47 are vulnerable; the update to 156.0.8078.47 includes the fix. No other vendors or product versions are identified.

The CVSS score of 8.8 indicates high severity. The EPSS score of < 1% suggests that exploitation is currently unlikely, though not impossible. The attack requires an attacker to serve a crafted HTML page that is then loaded in a Chrome WebUI context; on success, arbitrary code can run within the browser sandbox, potentially compromising the device and user data. The vulnerability is not listed in the CISA KEV catalog, so no active exploits are publicly known, but the lack of a known exploit does not diminish the high risk, as the flaw is theoretically straightforward to leverage, especially if users do not follow safety practices.