The flaw is an improper input validation in Chrome’s network layer that permits a remote attacker, through social engineering, to bypass the web origin policy and open a privileged page by delivering a crafted file. If a user opens or renders such a file, the attacker can run code with browser‑process privileges, potentially reading or modifying sandboxed data or using the page as a foothold for further attacks. The issue is classified as low severity by Chromium, but the CVSS score reflects a high‑impact scenario.

Google Chrome on any platform for versions earlier than 156.0.8078.47 is affected. No other vendors or product variants are noted.

An attacker can exploit the flaw remotely by displaying a crafted file, often delivered via a social engineering attack such as a malicious download or phishing link. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, signifying no widespread documented exploitation. Despite the low EPSS, the ability to execute code with browser‑process privileges at remote user interaction warrants prompt remediation.