A confused deputy flaw in the Extensions component of Google Chrome prior to 156.0.8078.47 allows a remote attacker to use social engineering and a specially crafted Chrome extension to bypass the web origin policy. The description does not explicitly state that this breach enables arbitrary code execution with sandbox privileges, but the bypass could potentially allow malicious code to run or other harmful actions within the browser context.

Google Chrome installations running any version prior to 156.0.8078.47 are affected. This includes the stable desktop channel releases available to general users. No other vendors or product lines are listed as impacted.

The CVSS score of 8.8 indicates a high severity level. Although the EPSS score is reported as < 1%, the vulnerability is not listed in CISA KEV, which does not diminish the potential risk. Attackers may exploit this flaw remotely by tricking users into installing a malicious Chrome extension or leveraging a social engineering campaign that urges installation of a compromised extension, after which the attacker can execute code within the browser sandbox.