A missing authorization flaw in Chrome’s internal components allows a remote attacker who has already compromised the renderer process to bypass the browser’s site isolation protections by serving a crafted HTML page. The CVE description indicates a potential privilege escalation inside the renderer; the possibility of arbitrary code execution is inferred from this bypass but is not explicitly stated.

Google Chrome users on desktop platforms running any version prior to 156.0.8078.47 are vulnerable. The flaw applies to the standard release builds that render web content and does not affect mobile or enterprise‑custom tokens.

The CVSS score of 9.6 marks the issue as critical. The EPSS score is listed as <1%, indicating a low but non‑zero likelihood of exploitation, and the vulnerability is not present in the CISA KEV catalog. Exploitation requires an attacker to first compromise the renderer process—possibly via another vulnerability—and then use the crafted HTML to bypass site isolation, potentially collapsing the browser sandbox and enabling broader access to the host.