Missing authorization in the Chrome extensions subsystem prior to version 156.0.8078.47 allows an attacker to bypass the browser’s web origin policy by delivering a crafted HTML page, as indicated by the CVE title. This flaw can give the attacker elevated privileges within the extension or browser context, potentially enabling arbitrary code execution.

All Desktop Chrome releases prior to version 156.0.8078.47 are affected. The vulnerability is present in any Chrome installation running an older version until it is updated to the specified 156.0.8078.47 release or later.

The CVSS score of 8.8 indicates a high severity issue. The EPSS score of < 1% indicates a very low but nonzero exploitation probability, and the vulnerability is not listed in CISA KEV. The flaw is a missing authorization error in the Chrome extensions subsystem that allows a remote attacker to bypass the browser’s web origin policy by delivering a crafted HTML page, for example through a malicious website or phishing email. By exploiting this loophole, the attacker could obtain elevated privileges within the extension or browser context and potentially execute arbitrary code, compromising the user’s system.