The origin validation error in DevTools still allows a remote attacker to bypass the web origin policy by loading a crafted HTML page, enabling social engineering to grant unauthorized cross‑origin access. The vulnerability can be exploited to gain unauthorized cross‑origin access but does not lead directly to code execution.

Google Chrome installations prior to version 156.0.8078.47 are affected. All platform builds of the stable channel that include the DevTools component are susceptible; the flaw is not limited to a specific operating system or environment.

The CVSS score of 8.8 classifies the flaw as high severity. EPSS indicates a very low exploitation probability (<1%). The flaw is not listed in CISA’s KEV catalog. The most likely attack vector is a social engineering scenario wherein a user opens a maliciously crafted HTML page in Chrome with DevTools enabled, which then bypasses the web origin policy and allows the attacker to access resources from other origins.