The vulnerability is an out‑of‑bounds read (CWE‑125) and involves improper resource cleanup (CWE‑459) in the Human Interface Device (HID) handling of Google Chrome. A remote attacker who compromises the renderer process, typically through social engineering that lures a user into installing a crafted Chrome extension, can exploit the incomplete cleanup to read data from the renderer's memory. This can expose sensitive information such as user credentials or other memory contents, and may bypass system access restrictions enforced by Chrome. The flaw does not grant direct code execution, but it compromises confidentiality by leaking sandbox memory.

Google Chrome browsers running any version prior to 156.0.8078.47 are affected. The issue was reported against code and applies to the stable channel of Chrome. Users of older Chrome releases should verify their version and upgrade when possible.

The CVSS score of 6.5 indicates medium severity, and the EPSS score is < 1%, indicating a very low but nonzero probability of exploitation. The flaw is not listed in the CISA KEV catalog, suggesting no known publicly used exploit. The likely attack vector is remote, via a malicious Chrome extension that an attacker encourages a user to install. Because the vulnerability only leaks memory inside the sandbox, it does not directly break sandbox isolation, but it can expose sensitive data to an attacker who controls the extension.