The vulnerability is an access‑control flaw in the FullScreen feature of Google Chrome versions prior to 156.0.8078.47. A maliciously crafted HTML page can exploit this flaw, allowing a remote attacker – typically via social engineering – to bypass system‑level access restrictions. This could grant unauthorized access to actions or data normally protected by the operating system. The flaw is a CWE-863 authorization failure.

The affected product is Google Chrome on desktop platforms. Any Chrome installation using a version older than 156.0.8078.47 is vulnerable. This applies to Windows, macOS, and Linux desktop builds. No specific operating system caveat is listed, so the vulnerability likely applies across all major desktop operating systems supported by Chrome.

Risk and exploitability: The CVSS score of 8.8 indicates high severity, and the vulnerability is an authorization bypass condition. The EPSS score of <1% implies a very low, but non‑zero, likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation at this time. An attacker would need to host or serve a malicious HTML page and persuade or trick a user to load it in Chrome, then leverage the FullScreen API to trigger the flaw. Because this is an access‑control weakness, the impact is confined to the browser context, enabling unauthorized actions within that environment.