The vulnerability is an inappropriate implementation in a Google Chrome API present in versions prior to 156.0.8078.47. It allows a remote attacker who has already compromised the renderer process to bypass system access restrictions by loading a specially crafted HTML page. The flaw is mapped to CWE-841 (Improper Authorization), and was rated as a medium severity issue by Chromium. Because the attack requires a compromised renderer, it facilitates privilege escalation within the browser context and potentially to the host system if the sandbox can be escaped.

All Google Chrome browsers running any version before 156.0.8078.47 are affected. No specific channel or platform distinctions are stated in the CVE, so every build of Chrome that has not been updated to the patched release is vulnerable.

The CVSS score of 8.8 indicates a high impact. The EPSS score of less than 1% suggests that exploitation is currently rare, and the vulnerability is not listed in CISA's KEV catalog, further implying low exploitation activity. The likely attack vector is a maliciously crafted HTML page served over the network or loaded locally while the renderer process has already been compromised. Once exploited, the attacker can bypass system access restrictions and potentially gain higher privileges within the host, leading to a full system compromise if sandbox escape is achieved. The vulnerability’s exploitation requires both the renderer compromise and the crafted page, limiting its practical impact.