The CVE highlights a flaw in Google Chrome’s CSS engine that lets a malicious web page cause the browser to reveal sensitive data stored in memory. A specially crafted HTML page with particular CSS constructs can trigger the disclosure, allowing attackers to read information that should remain private. While the bug does not enable arbitrary code execution, the leakage of confidential information could compromise user privacy and precede further attacks. The Chromium security severity is Medium, and the vulnerability is classified as CWE‑200, underscoring the need for strict validation and sandboxing of user‑supplied styles.

The issue affects every Google Chrome release earlier than version 156.0.8078.47 across all supported platforms—including Windows, macOS, Linux, Android, and iOS-derived browsers. Any installation that has not applied the stable‑channel update after this version remains vulnerable, regardless of network exposure, as the browser must render a tainted page to trigger the disclosure.

The CVSS score of 8.8 rates the vulnerability as high severity, while the Chromium security severity designation is Medium. The EPSS score is below 1 %, indicating that exploitation is currently unlikely but not impossible, and the bug is not listed in the CISA KEV catalog. Attackers would need to host or serve a malicious HTML document containing exploitative CSS, and the victim must load that page in Chrome. Because the bug does not provide remote code execution or privilege escalation, the risk is limited to confidentiality compromise via data exfiltration.