A flaw in Chrome’s DevTools authorization exists in versions earlier than 156.0.8078.47 and allows a remote attacker who can convince a user or otherwise exploit social engineering to deliver a crafted HTML page to bypass the web origin policy. This flaw, a CWE‑863 vulnerability, allows a malicious page to access or manipulate resources that would typically be protected by the same‑origin policy, potentially compromising data or actions within the browser.

Google Chrome browsers with versions prior to 156.0.8078.47 are affected.

The CVSS score of 8.8 indicates high severity, while the EPSS score of < 1 % reflects a very low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. An attacker with social engineering skills can craft a malicious HTML page that exploits the incorrect authorization in DevTools, allowing bypass of the web origin policy inside the browser. The attack vector is remote via crafted content.