The vulnerability is a confused‑deputy flaw in the WebAppInstalls component of Google Chrome that exploits a memory corruption bug. An attacker can craft a malicious HTML page that, when loaded in the victim’s browser, causes Chrome to bypass normal system access restrictions and act with higher privileges than the WebAppInstalls module normally allows. This privilege escalation can lead to remote code execution within the browser context. The flaw is classified as CWE‑441, and the CVSS score of 8.8 reflects its high severity.

All desktop versions of Google Chrome released before 156.0.8078.47 are affected. The CVE description does not specify whether mobile releases are impacted, so the scope for mobile platforms is unclear.

The CVSS score of 8.8 indicates a high potential for serious impact if exploited. The EPSS score of <1% and absence from the CISA KEV catalog suggest that widespread exploitation has not yet been observed. Based on the description, it is inferred that the attack vector is a web‑based attack that can be triggered simply by having the victim load a malicious HTML page in their browser, which means standard perimeter controls are largely ineffective.