An authorization check in Chrome’s Loader component fails for resources loaded in versions prior to 156.0.8078.47, allowing an attacker to construct an HTML page that tricks the browser into treating content from an untrusted origin as if it came from a trusted domain. This breach of origin isolation can enable the execution of malicious scripts or the reading of sensitive data, effectively compromising the integrity and confidentiality of the user’s browsing session.

All installations of Google Chrome older than 156.0.8078.47 are susceptible to this flaw. Upgrading to Chrome 156.0.8078.47 or later removes the vulnerability entirely.

The flaw is rated a CVSS score of 8.8, indicating high severity. The EPSS score of less than 1% conveys a low probability of exploitation in the near term, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a remote attacker to deliver a carefully crafted HTML page to a user, typically through phishing or a malicious website; active user interaction is needed to trigger the loader logic.