The vulnerability originates from a failure of authorization checks within Chrome’s Permissions API in versions prior to 156.0.8078.47. An attacker can exploit this by delivering a specially crafted HTML page that a user opens in the browser, enabling the attacker to bypass normal system access restrictions and potentially execute arbitrary code. The flaw corresponds to CWE-863, an improper authorization weakness, and is rated with a CVSS score of 9.6, indicating critical severity.

Google Chrome on all desktop platforms is affected; users running any version older than 156.0.8078.47 are vulnerable. The issue applies universally to desktop Chrome installations that employ the Permissions API, regardless of operating system or language variant.

The CVSS score of 9.6 signals close to maximum critical risk. The EPSS score of <1% suggests a very low current exploitation probability, but the vulnerability was publicly disclosed only a few days ago, raising the likelihood of active attacks. The flaw is not listed in the CISA KEV catalog. The attack vector is remote, relying on an attacker delivering a malicious HTML page to a user who has Chrome installed and opens it, usually via social engineering tactics.