Based on the updated description, incorrect authorization in the DevTools component of Google Chrome prior to version 156.0.8078.47 allows a remote attacker to bypass the web origin policy via a crafted HTML page, potentially enabling the execution of privileged JavaScript within the browser context. This flaw corresponds to CWE-863. If exploited, the attacker could gain unauthorized access to data or perform actions otherwise restricted by origin isolation, affecting confidentiality and integrity of the user’s browsing session.

Affected systems include Google Chrome browsers running any version before 156.0.8078.47 on any operating system that ships the DevTools component. The security advisory specifically references the stable channel update for this version series. Users of earlier versions are at risk until they upgrade.

The CVSS score of 8.8 indicates a high severity. The EPSS score of < 1% indicates a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA KEV. When triggered, an attacker can send a crafted HTML page that bypasses the web origin policy, potentially allowing execution of arbitrary JavaScript within the browser context. Based on the description, it is inferred that such exploitation could lead to unauthorized code execution. The most likely attack vector remains a remote web‑based attack from outside the network.