The vulnerability is an insufficient verification of data authenticity in the Variations component of Google Chrome prior to version 156.0.8078.47. An adjacent attacker can send crafted network traffic to bypass system access restrictions, enabling unauthorized actions within the browser process. The flaw is classified as CWE-345. The impact allows an attacker to circumvent built‑in access controls and potentially execute code inside the browser’s sandbox. By manipulating variation data delivered via the network, an attacker may gain privileges that could be leveraged for further compromise, such as credential theft or cross‑site scripting. Users interacting with untrusted web content are at risk. The risk remains high, judged by a CVSS score of 8.8, but the EPSS score of <1% indicates a low probability of exploitation. The vulnerability is not listed in KEV. The attack vector is network‑based, requiring the attacker to control traffic sent to the client or to inject malicious variation data; mitigation is by installing Chrome 156.0.8078.47 or later.

Google Chrome versions earlier than 156.0.8078.47 are affected.

The CVSS score of 8.8 indicates a high severity, reflecting the potential for serious impact if exploited. The EPSS score of <1% signals a low likelihood that the vulnerability will be actively exploited at this time, and the lack of KEV listing further suggests limited known exploitation activity. The attack vector is network‑based, likely involving crafted HTTP or other protocol traffic that reaches the Variations component. An attacker would need to influence traffic sent to or received by the client, possibly via a compromised CDN or internal network. While exploitation does not provide a direct sandbox escape, it permits local code execution within the browser’s renderer, which could enable additional attacks. Given these facts, administrators should act to eliminate the vulnerability as quickly as possible.