An authorization defect exists in FedCM, a federated credentials manager built into Google Chrome. The flaw, identified as CWE‑863, allows a remote actor to serve a specially crafted HTML page that causes the browser to accept cross‑origin requests as if they were originating from a trusted domain. This enables the adversary to access protected resources, potentially inject or modify content, and execute arbitrary code within the browser’s sandbox, thereby undermining web‑origin isolation and the overall security posture of the browser.

Any installation of Google Chrome that is older than version 156.0.8078.47 is susceptible. The vulnerability applies regardless of the underlying operating system or device because FedCM is part of the core browser stack.

The CVSS score of 8.8 places this vulnerability in the High severity category. The EPSS indicating less than 1% suggests exploitation likelihood remains low, and the vulnerability is not catalogued in the CISA KEV list. The attack vector is inferred to involve delivery of a crafted HTML page over the Internet, as the description specifies bypassing the web origin policy via a remote page.