The vulnerability is an improper input validation flaw in the WebAppInstalls component of Google Chrome. A crafted HTML page can trigger the flaw, allowing a remote attacker using social engineering to bypass system access restrictions and execute code outside the browser’s sandbox. If exploited, the attacker gains arbitrary code execution on the victim’s system, potentially compromising confidentiality, integrity, and availability.

Google Chrome versions before 156.0.8078.47 are affected. All users running these versions on any supported platform should consider the vulnerability.

This flaw carries a CVSS score of 9.6, indicating high severity. The EPSS score is < 1%, suggesting a very low probability of exploitation. The vulnerability is not listed in CISA KEV. The likely attack vector is a remotely served or locally opened crafted HTML page that leverages social engineering to trick the user. After a successful exploit, the attacker can escape the browser sandbox and gain full control of the host machine. The combination of a high CVSS score and a low EPSS score underscores the need for prompt remediation, despite the low exploitation probability.