An observable discrepancy in the Animation module in Google Chrome versions prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information by delivering a crafted HTML page. The vulnerability arises from a use‑after‑free condition that can expose private data from memory, but the CVE description does not explicitly say it enables remote code execution. The potential impact includes accidental or malicious exposure of confidential data that may be present in the browser’s memory, such as passwords, cookies, or local storage contents.

All users running Google Chrome older than 156.0.8078.47 on any supported desktop platform are affected. The product is Google Chrome; operating system details are not specified in the CVE, so the risk extends to the complete set of Chrome desktop installations.

The vulnerability carries a CVSS score of 8.8, indicating high severity, while the EPSS score of less than 1% shows a very low probability of exploitation at present. The issue is not yet listed in CISA KEV, suggesting no widespread active exploitation. The likely attack vector is a crafted HTML page supplied over the network that, when opened in the browser, triggers the Animation module’s use‑after‑free and causes private data to be read from memory. Successful exploitation would normally require the user to visit the malicious page. Because the flaw occurs in the rendering engine, automated attacks could be limited by same‑origin policies and sandbox boundaries; this inference is based on typical browser security design and is not explicitly stated in the CVE description.