The vulnerability stems from a missing authorization check in V8 of Google Chrome before version 156.0.8078.47, enabling a remote attacker to bypass the browser’s web origin policy with a crafted HTML page. This flaw is classified as an authorization issue (CWE-862) and could allow remote code execution outside the browser’s sandbox.

All Google Chrome releases before version 156.0.8078.47 are affected. The vulnerability does not apply to later releases that contain the V8 fix.

The CVSS score of 9.6 indicates critical severity. The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, so exploitation likelihood appears low, yet the remote nature and high severity indicate a substantial risk. The attack vector is likely a crafted HTML page that a victim opens, which exploits the missing authorization in V8 to bypass the web origin policy and potentially execute code outside the browser sandbox.