An improper resource exposure flaw was found in the PolicyContainer component of Google Chrome before version 156.0.8078.47. The flaw allows a remote attacker to supply a specially crafted HTML page that bypasses Chrome’s web origin policy and loads a privileged page. This means the attacker can gain access to privileged context normally protected by the same‑origin rule, potentially enabling the reading of sensitive data or the execution of actions that would normally require user interaction. The CVE report specifies the vulnerability as a medium‑severity issue within Chromium, but the CVSS score indicates a high severity of 9.6, reflecting the significant consequence of compromised browser isolation.

The vulnerability affects all installations of Google Chrome prior to version 156.0.8078.47, regardless of operating system.

With a CVSS score of 9.6 the potential impact is extensive, yet the EPSS score of less than 1% indicates that, as of the latest data, real‑world exploitation is unlikely. The flaw is not listed in the CISA KEV catalog, suggesting no documented active exploits. Attackers would need to deliver a malicious HTML file or page to the user, typically through phishing or compromised web sites, and rely on the browser’s default handling of PolicyContainer to load the privileged page.