The vulnerability in Google Chrome stems from improper resource exposure in the Privacy component, allowing a crafted HTML page to bypass the web origin policy. This flaw enables a remote attacker to execute arbitrary code outside the browser sandbox, potentially compromising the entire operating system. It is classed as CWE‑668, reflecting a failure to isolate private resources that leads to code execution and loss of confidentiality, integrity, and availability.

Google Chrome browsers with versions earlier than 156.0.8078.47 are affected. This includes all platforms where Chrome is installed (Windows, macOS, Linux, and Android). All users of these versions should treat the software as vulnerable until they apply the update.

The CVSS score of 9.6 classifies this flaw as critical, and the EPSS score of < 1% indicates a very low likelihood of exploitation, though the severity is high. The vulnerability can be triggered remotely by serving a malicious HTML page that a user opens or visits. Because the flaw bypasses the sandbox, the potential damage is complete system compromise. The flaw is not listed in the CISA KEV catalog, but its critical rating warrants immediate mitigation to prevent likely attacks.