Missing authorization in the Actor component of Google Chrome before version 156.0.8078.47 can allow a remote attacker who has compromised the renderer process to bypass system access restrictions through a crafted HTML page. This vulnerability exposes browsers to a sandbox escape, enabling potential confidential data leakage or system escalation. The issue is characterized as CWE-125 and CWE-862, indicating an out-of-bounds read and missing authorization flaw.

Affected vendor: Google, product: Chrome. All Chrome installs running versions before 156.0.8078.47 are potentially vulnerable. No precise version list is available beyond the stated cutoff.

The vulnerability could be exploited by hosting a malicious web page or manipulating an existing page to trigger the Actor missing authorization. The attack vector is inferred to be through a crafted HTML page delivered to the user, as the description references an attacker controlling a web page. The CVSS score of 6.5 indicates moderate severity, while the EPSS score of < 1% reflects a low exploitation probability. It is not listed in the CISA KEV catalog, suggesting no confirmed public exploit yet.