The CVE describes a missing authorization flaw in the DevTools component of Google Chrome prior to version 156.0.8078.47. This allows a remote attacker to bypass the browser's web origin policy through a crafted Chrome extension, enabling execution of arbitrary code within the browser's sandbox. The vulnerability is categorized as CWE-862, highlighting an insufficient authorization check.

All installations of Google Chrome on the stable channel before 156.0.8078.47 are vulnerable. Users running older stable channel builds are at risk, while beta or unstable builds are not explicitly noted as affected but may share the same underlying codebase. The problem lies in the DevTools code embedded in the default browser image, so any legacy build that has not been updated to the patch release remains susceptible.

The CVSS score of 8.8 signals a high severity, and the documented exploitation path via a malicious extension indicates that an attacker can achieve remote code execution on the user’s machine. Although the EPSS score is below 1%, suggesting a low probability of widespread exploitation, the lack of a CISA KEV listing does not diminish the risk. The likely attack vector involves a social engineering campaign to entice a user into installing a malicious extension, thereby triggering the missing authorization flaw and allowing the attacker to run arbitrary code.