Incorrect authorization in the ServiceWorker subsystem of Google Chrome versions older than 156.0.8078.47 permits a remote attacker who has already compromised the renderer process to bypass site isolation through a specially crafted HTML page. This flaw is a CWE‑863 weakness allowing the attacker to elevate privileges within the isolated context, potentially enabling privilege escalation or remote code execution on the host machine.

The affected product is Google Chrome. All Chrome releases dated prior to 156.0.8078.47 are vulnerable. Users must ensure their browser is upgraded to 156.0.8078.47 or later to receive the patch that fixes the authorization flaw.

The CVSS score of 9.6 indicates a critical severity. EPSS is <1% and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote exploitation through a malicious web page that tricks the victim into visiting a site serving a crafted HTML payload. If the exploit succeeds, the attacker can bypass site isolation, potentially granting higher privileges and enabling further attacks such as data theft or system compromise.