Incorrect authorization in the Core module of Google Chrome on macOS versions prior to 156.0.8078.47 allows a remote attacker who has compromised the renderer process to bypass the web origin policy through a crafted HTML page. This flaw represents a class of incorrect authorization vulnerabilities (CWE-863) and can enable an attacker to read data otherwise protected by the browser’s sandbox boundaries.

The flaw impacts Google Chrome on macOS users that have installed any stable channel build earlier than version 156.0.8078.47. The affected system architecture is the sandboxed browser process; only Chrome on macOS is explicitly listed.

The CVSS score of 6.5 indicates moderate severity and is consistent with the Chromium Medium rating. The EPSS score of <1% reflects a low likelihood that this vulnerability is actively exploited in the wild. The vulnerability is not listed in the CISA KEV catalog. Attack vectors inferred from the description involve an attacker having already compromised the renderer process and using social engineering to serve a malicious web page, enabling the attacker to bypass the web origin policy. The issue was addressed by updating Chrome to 156.0.8078.47, which removes the incorrect authorization flaw.