Missing authorization in a Chrome API before 156.0.8078.47 allows a remote attacker who has already compromised the renderer process to bypass the web origin policy by presenting a crafted HTML page. This broken access control can expose privileged content or enable the attacker to execute code that would normally be denied. The vulnerability is classified as CWE-862 and is currently marked as Medium severity by Chromium.

Google Chrome browsers prior to version 156.0.8078.47 are affected; all users running these builds are at risk.

The CVSS score of 8.8 indicates a high severity, and the EPSS score of < 1% indicates a very low exploitation probability. This vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a maliciously crafted HTML page that also requires the attacker to have already compromised the renderer process; the initial compromise may be performed via another vulnerability, after which the attacker can trigger the broken authorization to bypass the origin policy and potentially execute arbitrary code, as described in the updated vulnerability statement.