The vulnerability is an incorrect authorization flaw in Chrome’s Prompts component before 156.0.8078.47 that allows a remote attacker, using a crafted HTML page, to bypass system access restrictions. This can create unauthorized access or privilege elevation within the browser context, but it does not provide arbitrary code execution. The flaw is a CWE‑863 type improper authorization weakness.

All Chrome versions older than 156.0.8078.47 on supported operating systems are affected.

The CVSS score of 8.8 indicates high severity. The EPSS score is less than 1%, indicating a very low but non-zero likelihood of exploitation, and the vulnerability is not listed in CISA KEV. The attack vector is remote, originating from a malicious web page that a user visits, leveraging social engineering. Exploitation would allow a remote attacker to bypass Chrome’s authorization checks on prompts, potentially giving the attacker unauthorized access to browser‑level resources or actions normally restricted by the browser. This flaw does not grant arbitrary code execution; it is a privilege escalation within the browser context, but its effect on higher‑level system functions is not explicitly stated in the CVE data, so any claim about impact beyond the browser is an inference.