Improper signature verification in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. This bypass can enable the attacker to perform actions that would normally be restricted by the same‑origin rule, potentially leading to cross‑site data theft or other malicious activity.

The flaw affects all installations of Google Chrome that are older than 156.0.8078.47. Users running any earlier stable channel version are vulnerable.

The CVSS score of 8.8 indicates a high risk level in the CVSS framework, while Chromium classifies the issue as low severity, suggesting that the practical impact may be limited. The flaw can be triggered by any web page containing a specially crafted HTML fragment, making the attack vector remote via the network. An attacker controlling a malicious site can exploit the improper signature verification to bypass the origin policy. With an EPSS score of less than 1% and no listing in the CISA KEV catalog, the likelihood of exploitation appears low, but the potential to undermine the same‑origin security model warrants timely remediation.