The vulnerability is an input validation flaw in the Chromoting component of Google Chrome. It allows a remote attacker to deliver crafted network traffic that bypasses the browser’s system access restrictions. This flaw can provide the attacker with unauthorized access to system functions through a browser session powered by Chromoting, without requiring local privileges. The weakness is classified as CWE-20, indicating a general issue with input handling.

All versions of the Google Chrome desktop browser older than 156.0.8078.47 are impacted. The flaw resides solely in the Chromoting feature; any machine running Chrome with the Chromoting function enabled and capable of rendering the malicious content is at risk.

The CVSS score of 8.8 signals a high-severity flaw, yet the EPSS score of less than 1% indicates that real‑world exploitation is currently rare. The vulnerability is not listed in CISA’s KEV catalog. A successful exploit requires a remote attacker to send specially crafted traffic, typically via social engineering that directs the user to a malicious site. Because only Chrome instances with Chromoting enabled are affected, the impact is confined to those environments, but the potential to gain unauthorized system access makes it a serious concern when the feature is in use.