Improper access control in Google Chrome Forms prior to 156.0.8078.73 permits a remote attacker to bypass the web origin policy through a crafted HTML page. A malicious page can read or modify data that should be sandboxed to a different origin, leading to potential data theft, session hijacking, or code execution within the victim’s authorized site. This weakness is classified as CWE-284, an inappropriate restriction on access rights.

Google Chrome browsers built on revisions earlier than 156.0.8078.73 are affected. Users of the stable channel that have not yet updated to this revision are at risk until the proper access control is applied in a future release.

The flaw carries a high security severity in Chromium’s assessment; EPSS data is not available and it is not listed in the CISA KEV catalog. Attackers can exploit the vulnerability remotely by delivering a targeted HTML page that the user opens. Because the failure of origin isolation can expose sensitive data, the threat is significant when users interact with web content that may contain confidential information. The risk assessment relies on the high severity and the potential for critical confidentiality and integrity compromise.