An incorrect authorization flaw in Chrome’s SiteIsolation feature before version 156.0.8078.47 lets a crafted HTML page potentially execute code outside the browser sandbox. This is a CWE‑863 issue involving improper authorization, allowing a remote attacker who has compromised the renderer process to run code with renderer privileges; the attacker can then attempt to escape the sandbox and potentially compromise the host system.

Google Chrome browsers with a version number lower than 156.0.8078.47 on any platform that uses the SiteIsolation sandbox are affected. The fix is included in Chrome 156.0.8078.47 and later.

The CVSS score of 8.8 indicates a high level of severity. The EPSS score indicates a very low likelihood of exploitation, and no known public exploits are listed in the KEV catalog. The vulnerability can be leveraged by serving a crafted HTML page or directing a victim to a compromised site. Because the flaw operates inside the sandbox, a successful exploitation could lead to arbitrary code execution with renderer‑level privileges, which may enable further attacks against the host operating system.