Missing authorization in Google Chrome’s Input module before version 156.0.8078.47 lets a remote attacker who has already compromised the renderer process load a specially crafted HTML page that bypasses site isolation. Because site isolation relies on proper authorization checks, the flaw permits the attacker to escape boundaries that separate different web sites, effectively elevating their privileges within the browser to access data or control other sites’ content. This privilege escalation is confined to the browser environment and does not grant straight system‑level code execution. The issue is classified under CWE‑862, which indicates a missing authentication/authorization flaw.

Google Chrome versions earlier than 156.0.8078.47. The vulnerable component is the Input module used to process HTML content. Administrators should update all Chrome installations to at least 156.0.8078.47. If updating is not possible, lock down untrusted web content as a precaution.

The CVSS score of 8.8 indicates high severity. The EPSS score of <1% shows a low likelihood of exploitation, and the vulnerability is not listed in CISA KEV, suggesting no known mass exploitation. The likely attack vector involves a remote attacker delivering a malicious HTML page to a user’s browser after the renderer process has been compromised. The missing authorization during Input processing allows the attacker to cross the site isolation barrier, achieving privilege escalation within the browser, but this does not automatically grant external code execution without further compromise. The risk remains primarily confined to the browser context.