The vulnerability is a missing authorization in Glic, a component of Google Chrome. A crafted HTML page can be delivered to a user, and when opened in a vulnerable browser, the attack bypasses system access restrictions, potentially allowing execution of arbitrary code in the context of the Chrome process. This flaw can be used to compromise the confidentiality, integrity, and availability of the user’s device if successful.

All Google Chrome browsers running version 155.x and earlier on any platform are affected. The issue is present in stable channel releases and any build that includes the Glic module before 156.0.8078.47.

The flaw carries a CVSS score of 8.8, indicating high severity. The EPSS score is less than 1 %, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a malicious HTML page that relies on social engineering to persuade a user to open it in a vulnerable Chrome instance. No other prerequisites are indicated in the CVE data, so the attack is feasible with only user interaction.