The flaw is a missing authorization check within Google Chrome’s editing subsystem that allows a crafted HTML page to trigger a privileged editing action. When this path is abused, the attacker can bypass the browser’s normal system access restrictions, potentially reading or modifying sensitive data, launching code, or performing other unauthorized operations. This missing control is an elevation of privilege vulnerability.

All installations of Google Chrome older than 156.0.8078.47, specifically those on the stable channel that have not yet received the patch, are susceptible.

The CVSS score of 8.8 indicates high severity while the EPSS score remains below 1%, reflecting a very low but non‑zero likelihood of exploitation in the wild. The affected rule is not listed in CISA’s KEV catalog, so no confirmed exploits are known at this time. The likely attack vector is a malicious HTML page that the attacker hosts or injects into user traffic, which directs the victim’s browser to invoke the vulnerable editing function.