Incorrect authorization in the Transactions Platform of Google Chrome before version 156.0.8078.47 lets a remote attacker use a crafted HTML page and social engineering to obtain sensitive information. The vulnerability could allow disclosure of data that should otherwise be protected, potentially facilitating further attacks. The weakness is identified as CWE‑863, an authorization issue.

Chrome versions earlier than 156.0.8078.47 on desktop platforms are affected. The vulnerability impacts all installations of Google Chrome that have not been updated to the 156.0.8078.47 release or newer.

The vulnerability carries a CVSS score of 6.5, classifying it as medium severity. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a crafted HTML page that a user must open in Chrome, indicating that a social‑engineering or phishing scenario would be required. Risk remains moderate until a public exploit is discovered or the CVSS score is updated.