A flaw in Chrome’s network module performs an incorrect authorization check, which allows a remote attacker who has already compromised the renderer process to bypass the browser’s web origin policy with a specially crafted HTML page. This access violation permits the attacker to view or interact with resources that should be protected by the same‑origin rule, potentially enabling manipulation of page content or reading data from another origin. The vulnerability is rated medium by Chromium’s internal assessment and carries a CVSS score of 8.8, indicating a high severity risk when exploited.

All desktop installations of Google Chrome that use the network component before version 156.0.8078.47 are affected. This includes releases 156.0.8078.46 and earlier, across Windows, macOS, and Linux operating systems. The flaw was fixed in the 156.0.8078.47 update, so any system running a newer build is immune.

The CVSS score of 8.8 highlights strong exploitability, but the EPSS score of <1% and the lack of a CISA KEV listing suggest that large‑scale exploitation has not yet been observed. The vulnerability requires a renderer process to be compromised first, which an attacker could achieve via earlier exploitation or social engineering. Once in the renderer, the attacker can bypass the same‑origin policy, potentially accessing sensitive resources or manipulating content from trusted sites. Given the potential impact and the fact that the flaw exists in widely deployed software, prompt patching is recommended.