A missing authorization check in the BrowserTag component of Google Chrome before version 156.0.8078.47 allows a remote attacker who has already compromised the renderer process to bypass system access restrictions by loading a specially crafted HTML page. The flaw provides a privilege‑escalation path within the browser, potentially enabling the attacker to access resources or perform actions normally blocked by the sandbox. The weakness is described by CWE‑862, Missing Authorization.

Google Chrome desktop installations on all major operating systems. All stable‑channel releases before 156.0.8078.47 are affected. Any system running an unpatched Chrome version and exposed to untrusted web content is at risk.

The CVSS score of 8.8 indicates high severity, while the EPSS score of <1% suggests a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker must first succeed in compromising the renderer process, typically by luring a user to open a malicious webpage, and then use the crafted HTML to bypass sandbox restrictions. The flaw offers a path for privilege escalation rather than arbitrary code execution, as inferred from the official description.