Improper privilege management in Google Chrome's Permissions module allowed a remote attacker, using social engineering, to bypass sandbox restrictions through a crafted HTML page. The vulnerability could enable the browser to perform privileged actions normally confined within the sandbox, potentially exposing sensitive user data accessed by the browser. The description does not state that code could execute outside the sandbox.

All installations of Google Chrome earlier than 156.0.8078.47 on any platform that can load arbitrary HTML from the network, inferred from the vulnerability details.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests the likelihood of exploitation is very low at present. The vulnerability is not listed in the CISA KEV catalog, with no widespread exploitation reported. Based on the attack description, an attacker would need to deliver the malicious HTML to a victim’s browser, typically using social engineering techniques.