The flaw is a missing‑authorization vulnerability in Chrome’s Views module on macOS. A crafted HTML page that a user visits can trigger code that bypasses the browser’s sandbox, enabling arbitrary code execution outside the browser process. The weakness is identified as CWE-862.

Google Chrome on macOS versions prior to 156.0.8078.47 are affected. The flaw resides in the Views module and applies to any user running these older builds.

The vulnerability requires that the attacker has compromised the renderer process or delivers a crafted HTML page to a user. Once accessed, the missing authorization flaw can be leveraged to execute code outside the browser’s sandbox. The EPSS score of less than 1% indicates a low overall exploitation probability. The CVSS score of 6.5 classifies the vulnerability as Medium severity, and it is not listed in CISA’s KEV catalog. Still, the ability to escape the sandbox elevates the risk, warranting prompt remediation.