The vulnerability resides in the Video module of Google Chrome and results from a missing authorization check. A crafted HTML page can trigger the flaw, allowing a remote attacker to bypass the browser’s web origin policy. If successful, the attacker could read or modify data belonging to other web origins, potentially exfiltrating sensitive information or injecting malicious content. The weakness is classified as CWE-862.

Google Chrome versions prior to 156.0.8078.73 are affected. The vulnerability impacts the Chrome desktop browser across all supported operating systems that use the Video component without the applied patch. Users running older builds must update to the forthcoming 156.0.8078.73 release or later to eliminate the issue.

No EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog, indicating no publicly known exploitation yet. Nonetheless, the CVE is rated as high severity, and the attack vector is likely to be a remote attacker supplying a specially crafted HTML page through a website or email link. Given the absence of known mitigations, the risk is considered significant for any system that renders or processes video content within Chrome. Prompt remediation is advised to prevent potential compromise.