Improper input validation of PDF files in Google Chrome versions earlier than 156.0.8078.47 allows a remote attacker to bypass the browser's web origin policy through a crafted HTML page. The flaw does not provide direct code execution but enables cross-origin access to data normally protected. Chromium's security team classifies the issue as low severity.

Google Chrome browsers running versions earlier than 156.0.8078.47 are affected. The vulnerability exists in the PDF parsing component that is invoked when a PDF is referenced from an HTML page.

The vulnerability carries a CVSS score of 8.8, indicating high severity. EPSS score of < 1% shows a very low but nonzero probability of exploitation, and it is not listed in CISA's KEV catalog, suggesting limited public exploit data. The likely attack vector is a remote web-based exploit where an attacker hosts a malicious HTML file that embeds a crafted PDF. If a victim opens or otherwise processes the page, the input validation flaw can be triggered, leading to a web origin policy bypass. Given the high CVSS score and remote nature of the attack, the risk to affected users remains significant until the vulnerability is remediated.