Confused deputy flaw in the ServiceWorker implementation of Google Chrome allows a remote attacker using social engineering to surpass browser origin restrictions by loading a specially crafted HTML page. When such a page loads, Chrome inadvertently bypasses its normal security checks and runs code within the user’s sandbox. This enables the attacker to read or alter user data and potentially introduce malware, all while operating under the browser’s privileges.

Users of the stable channel desktop version of Chrome with a build before 156.0.8078.47 are affected. The fix is released in the stable channel update of that version, and no later revisions before that export the vulnerability. Versions on other channels or operating systems are not listed as impacted.

The attack vector is inferred to be remote, requiring only that a user visits a malicious page; this inference is based on the description of the exploit via a crafted HTML page. The EPSS score is shown as less than 1 %, indicating a very low probability of exploitation in the wild. The CVSS score of 8.8 signals a high severity risk, and the vulnerability is not yet listed in the CISA KEV catalog, so no active exploits are known. Nevertheless, the combination of a high CVSS, the nature of the flaw, and the potential to run code inside the user’s sandbox warrants careful attention.