A missing authorization flaw exists in the compositing component of Google Chrome before version 156.0.8078.47. The flaw allows a remote attacker who has compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. This high‑severity missing authorization (CWE-862) flaw carries a CVSS score of 8.8, indicating that a successful exploit could compromise confidentiality, integrity, or availability of the victim machine. The impact is limited to execution inside the Chrome sandbox but can provide the attacker with significant capability to exfiltrate data or perform malicious actions beyond the browser context.

Google Chrome versions prior to 156.0.8078.47 are affected. Users running any older stable release of Chrome on desktop platforms are vulnerable; the patch is available in the latest stable channel update.

The flaw can be triggered remotely by a user who opens a malicious HTML page or clicks a compromised link, implying an indirect attack vector that requires user interaction. The CVSS metric indicates a high potential for exploitation, but the EPSS score is < 1%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet, yet the severity warrants immediate remediation.