The vulnerability is a missing authorization check in Chrome’s ShadowDOM that enables a remote attacker to bypass the browser’s web origin policy when a crafted HTML page is loaded. The CVE description states that this flaw allows the attacker to circumvent the origin boundary, effectively granting them the same privileges as the sandboxed context. It is a high‑severity issue, with the vendor rating it as a medium severity flaw for Chromium. The impact is limited to the web context of the browser; it does not imply that the attacker can execute code on the host operating system directly.

Affected systems include Google Chrome desktop installations running any version before 156.0.8078.47 on the stable channel. Versions newer than or equal to 156.0.8078.47 contain the fix that restores proper authorization in ShadowDOM.

Risk and exploitability are characterized by a CVSS score of 8.8, indicating high severity. The EPSS score is reported as less than 1 %, suggesting a very low probability of exploitation in the current threat landscape. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to host a malicious HTML page and entreat a user to load it, meaning the threat depends on user interaction. Given the high CVSS, the risk remains significant, but the low EPSS indicates that exploitation of this flaw is not common at present.