The flaw is a race condition in the Transactions Platform of Google Chrome. If the renderer process is already compromised and a malicious web page is loaded, a remote attacker can trigger the race through a specially crafted HTML page. This can lead to the disclosure of sensitive information. The issue is identified as CWE‑367.

Any installation of Chrome prior to version 156.0.8078.47 is affected. This includes all desktop builds of the stable channel and other builds that use the same Transactions Platform code base before the stated patch. Users running earlier revisions of Chrome on Windows, macOS, or Linux are therefore vulnerable.

The CVSS score is 8.8, indicating high severity, and the EPSS score of < 1% indicates a very low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires a victim to load a malicious HTML page, meaning social engineering or compromised sites could be used. Once the crafted page is rendered, the race condition can lead to memory corruption that may expose sensitive information. The risk to users is significant, especially those who encounter untrusted web content frequently.