Missing authorization in Google Chrome extensions prior to version 156.0.8078.47 allows a remote attacker to bypass the browser’s web origin policy via a crafted HTML page. By exploiting this flaw, an attacker can override origin restrictions, potentially compromising user data and web content integrity.

Google Chrome browsers running a version earlier than 156.0.8078.47 are affected. Any user who installs or uses extensions that have not been updated to this version is at risk.

The CVSS score of 8.8 indicates a high severity potential. The EPSS score of < 1% indicates a very low public exploitation probability, and the lack of listing in the CISA KEV catalog suggests no publicly reported exploitation yet. The likely attack vector is a malicious HTML page that a user opens, which the browser renders with the vulnerable extension. The exploit requires the victim to visit a crafted page, so social engineering or drive‑by download tactics are probable. By exploiting this flaw, an attacker can bypass the web origin policy, enabling cross‑origin requests that could lead to data theft or content injection.