A confused deputy bug in the BrowserTag component of Google Chrome allows an attacker who has compromised the renderer process to bypass the web origin policy via a crafted HTML page. The flaw enables the attacker to execute code within the browser’s sandboxed environment, running with the same privileges as the user’s browser process, without needing privilege escalation.

Google Chrome browsers on all supported platforms running versions earlier than 156.0.8078.47 are impacted.

The CVSS score of 8.8 reflects the high severity of this remote code execution flaw. The EPSS score of < 1% indicates a very low but non-zero probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is a malicious web page that the user opens or visits, requiring no special user action beyond standard browsing. Exploitation would allow the attacker to run code with the privileges of the browser process, potentially enabling further compromise of the host system.