Information loss in the Script component of Google Chrome prior to version 156.0.8078.47 enables a remote attacker to craft a malicious HTML page that bypasses the browser’s web origin policy. The vulnerability allows the attacker to read or manipulate data across origin boundaries within the sandboxed process, potentially escalating to higher‑privilege execution depending on the host environment.

The flaw affects Google Chrome browsers running any version earlier than 156.0.8078.47 on desktop platforms. All users must update to a supported release to eliminate the risk.

The CVSS score of 8.8 indicates a high potential for exploitation. The EPSS score is reported as <1%, implying a very low but non‑zero public exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote HTML page served to the victim’s browser, and an attacker can use the origin policy bypass to read data across origins or inject code confined to the sandbox, potentially reviving it into higher‑privilege contexts depending on the host configuration.