The vulnerability is a missing authorization check in Chrome's PerformanceAPIs. When a crafted HTML page is rendered, the browser may expose performance metrics from other origins because the API does not verify caller permissions. This flaw allows an attacker to obtain cross‑origin data.

Affected systems are installations of Google Chrome prior to version 156.0.8078.47. All users running the stable channel older than that revision are at risk. No specific vendor patch list is provided, but the update that addresses the issue is released in that version and later releases.

The CVSS score of 9.6 indicates a high‑severity weakness. The flaw is a missing authorization check in the PerformanceAPIs that allows a malicious web page to obtain cross‑origin data, a classic authorization flaw (CWE‑862). The EPSS score of <1% suggests low current exploitation probability, and it is not listed in CISA's KEV catalog. Nevertheless, the attack vector remains a malicious web page that a user visits, so risk is significant for users who load untrusted content.