The vulnerability is a missing authorization check in the AppManifest of Google Chrome, allowing a remote process to bypass the web origin policy by serving a specially crafted HTML page. This bypass can enable the attacker to access or manipulate resources that should be restricted, potentially leading to data leakage or execution of untrusted code by the end user. The weakness is identified as missing authorization (CWE-346) and improper access (CWE-862).

Google Chrome versions prior to 153 on all supported platforms are affected. The issue concerns the AppManifest component, which is present on Windows, macOS, Linux, and Chrome OS.

The vulnerability has a CVSS score of 7.2, indicating high severity. The EPSS score is less than 1%, showing a very low probability of exploitation at this time. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires that the attacker already gains a foothold in the renderer process, which typically involves a separate vulnerability or social engineering. Once inside, the attacker can craft an HTML page to trick the user into loading it, thereby bypassing the same‑origin policy.