An incorrect authorization flaw in Chrome’s Sandbox component, identified as CWE-863, allows a remote attacker who has compromised the renderer process to bypass the sandbox and potentially execute arbitrary code outside the browser’s isolation. The attacker crafts a malicious HTML page that the affected renderer processes render, leading to code execution that could compromise the integrity of the browser and, if sandbox defenses are bypassed, the underlying host system.

Google Chrome browsers on any stable channel build older than 156.0.8078.47 are affected. This includes all operating systems that can run Chrome – Windows, macOS, and Linux – because the vulnerability resides in the cross-platform sandbox code. Users who have not yet updated to the patched release remain at risk while the renderer process remains untrusted.

The severity score of 8.8 indicates a high impact, but the EPSS score of <1% reflects a currently low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation in the wild. The likely attack vector is a remote attacker serving a crafted HTML page from a malicious website or compromised web content that tricks the compromised renderer into executing the injected code. Successful exploitation could lead to arbitrary code execution within the sandbox process and, due to the incorrect authorization flaw, potential escape into the host environment.