The vulnerability is an information leak in Chrome's Core component prior to version 156.0.8078.47. A crafted HTML page can cause the renderer process, once compromised, to expose cross‑origin data. The flaw allows a remote attacker to obtain sensitive information, rather than execute code in the sandbox, and is classified as CWE‑200.

Google Chrome desktop applications (stable channel) with versions up to 156.0.8078.46 are affected. The issue was fixed in Chrome 156.0.8078.47 and later releases.

The CVSS score of 8.8 indicates a high severity for data disclosure, while the EPSS score of < 1% suggests a low yet non‑zero exploitation probability. The vulnerability is not listed in CISA’s KEV catalog and is not known to be exploited publicly. Attackers would need to trick a user into opening a malicious web page that triggers renderer compromise; once the renderer is compromised, cross‑origin data may be read, exposing session tokens, credentials, or other sensitive information.