The flaw is an incorrect authorization in Chrome’s Actor component, present in all desktop releases prior to 156.0.8078.47. A remote attacker leveraging social engineering can deliver a crafted HTML page that the victim opens, allowing the attacker to bypass the browser’s web‑origin policy. Classified as CWE-825 and CWE-863, the weakness permits an attacker to read or manipulate data that should be confined to the originating web origin, resulting in loss of confidentiality and integrity for the user’s web data.

Google Chrome desktop releases prior to 156.0.8078.47 are affected. The flaw resides in the Actor component that renders web content, and it applies to all supported desktop operating systems.

The CVSS score of 8.8 indicates a high severity, reflecting the potential to compromise important data. The attack vector is inferred as a malicious HTML page that the victim opens, suggesting that social engineering or hosting a malicious site could be used. The EPSS score is less than 1%, indicating a very low exploitation probability at the time of analysis. The vulnerability is not listed in the CISA KEV catalog, but the high CVSS score and possible impact warrant prompt remediation.