Incorrect authorization in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. The flaw results from improper verification of access rights during the SignIn flow, enabling the attacker to override system access constraints.

The vulnerability affects Google Chrome browsers on desktop operating systems. Any installation of Chrome prior to patch 156.0.8078.47 is susceptible, including clients on both the stable and non‑stable channels. Users who have not installed the latest update are at risk.

The CVSS score of 8.8 characterizes this vulnerability as a high‑severity flaw that could allow remote access bypass. The EPSS score is reported as less than 1 percent, indicating a low probability of exploitation at the time of analysis, and the vulnerability is not listed in CISA’s KEV catalog, meaning no confirmed exploitation has been reported. Based on the description, the likely attack vector is a malicious crafted HTML page that exploits an incorrect authorization in the SignIn flow, requiring the attacker to first compromise the renderer process. Because the flaw is remote and does not require privileged access beyond compromising the renderer, the risk to widespread deployments remains significant, warranting prompt mitigation.