Privilege elevation in the Network component of Google Chrome before version 156.0.8078.47 lets a remote attacker, leveraging social engineering techniques, avoid the browser’s web origin policy by delivering a crafted HTML page. This flaw is a CWE-250 vulnerability, allowing execution with privileges of less privilege than normally allowed and can lead to execution of code with higher privileges than the browser sandbox normally permits, potentially enabling full compromise of the victim’s system.

All installations of Google Chrome older than version 156.0.8078.47 are susceptible.

The EPSS value is < 1%, the flaw is not listed in the CISA KEV catalog, and the CVSS score is 9.6, indicating a critical threat. Attackers can exploit it by delivering malicious HTML through phishing, compromised sites, or other social engineering techniques; if successful, it would allow execution of code with the privileges of the logged‑in user, bypassing the browser sandbox.