Incorrect authorization in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. This permits access to resources protected by same‑origin restrictions, potentially exposing sensitive user data or enabling pivot attacks. Though rated low severity by Chromium, the flaw remains exploitable with user interaction.

The flaw affects Google Chrome versions prior to 156.0.8078.47. Systems running any earlier release of the Chrome browser are vulnerable. This includes both desktop and potentially other platforms that ship with the same upstream Chromium code base.

The vulnerability is remote, delivered through a malicious web page. Because the exploit requires the user to open a crafted page, the attack vector is application‑layer and requires user interaction. The EPSS score is less than 1%, and the flaw is not listed in the CISA KEV catalog, suggesting limited known exploitation. The CVSS score of 6.5 indicates a moderate severity, implying a higher likelihood of exploitation than low severity but still not trivial; however, bypassing the same‑origin policy still poses a serious risk to sensitive data.