An incorrect authorization flaw in Chrome’s SiteIsolation component before version 156.0.8078.47 allows a remote attacker to bypass system access restrictions by delivering a crafted HTML page. The flaw enables the page to access privileged resources, permitting unauthorized system access.

Google Chrome running on Android devices is affected. Versions prior to 156.0.8078.47 are vulnerable; any build using that or earlier common code should be considered at risk.

The CVSS score of 8.8 indicates high impact and difficulty. The EPSS score (<1%) shows that exploitation probability is very low, but it is not zero. The vulnerability is not listed in CISA KEV. Attackers can exploit the flaw by delivering a malicious webpage to a user’s device; by bypassing system access restrictions, it can lead to privilege escalation.