According to updated information, the flaw is an incorrect authorization in the Chrome Extensions subsystem. A remote attacker who has compromised the renderer process can craft a malicious HTML page that the browser will treat as a privileged page, bypassing system access restrictions. This allows the attacker to execute arbitrary code within the privileged browser context, breaking the sandbox and enabling data theft or further privilege escalation.

Google Chrome users running any version prior to 156.0.8078.47 are affected. Updated builds past this version contain the patch that removes the vulnerable code path.

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score is below 1 %, implying a very low historical exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog, so no confirmed active exploitation is known. The likely attack vector is a malicious or compromised HTML page that the user opens or that the browser loads in a tab; a remote attacker could host such a page. Because the flaw involves incorrect authorization in the extensions subsystem, exploitation requires the attacker to provide a crafted page, but once triggered it can bypass the sandbox and execute code within the Chrome process.