Missing authorization in the Document Object Model handling of Google Chrome versions prior to 156.0.8078.47 allows a remote attacker to craft an HTML page that lets them read cross-origin data. The vulnerability, identified as CWE-862, does not require any privileged access or user interaction beyond visiting a malicious page. By bypassing the browser’s same-origin policy, the attacker can exfiltrate data that would normally be inaccessible, posing a significant confidential data breach risk.

Google Chrome browsers below version 156.0.8078.47 on desktop platforms are vulnerable. The affected product is listed under the CNA vendor/product name Google:Chrome.

CVSS score of 8.8 signals high severity, reflecting the potential for significant data exposure. EPSS is below 1 percent, indicating a low but non-zero likelihood of exploitation. The vulnerability is not in the CISA KEV catalog. A remote attacker can trigger the flaw through a malicious website or file, bypassing same-origin restrictions, and leak user data. Because the attack can be performed from a remote web page, it does not rely on local privileges, and any user who visits the crafted page is at risk.