A confused deputy flaw in the SignIn component of Google Chrome can be triggered by a remote attacker who uses social engineering to bypass the web origin policy through a crafted Chrome extension. This vulnerability allows the attacker to execute arbitrary code inside the browser’s sandbox, potentially compromising the confidentiality, integrity, and availability of the system on which the malicious page is rendered.

Google Chrome browsers running any version prior to 156.0.8078.47 are affected. The problem manifests in the stable channel of Chrome, so all users below that build are potentially vulnerable.

The flaw carries a CVSS score of 8.8, indicating high severity. The EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by convincing users to install a specially crafted Chrome extension that abuses the SignIn component’s confused deputy; the required input is only a user’s willingness to install the extension, making the attack vector remote and not requiring elevated privileges on the host.