The vulnerability is an observable discrepancy in the PerformanceAPIs component of Google Chrome. When the browser processes specially crafted HTML content, a remote attacker can trigger leakage of cross‑origin data from the browser’s internal memory. This flaw corresponds to improper access control (CWE‑203) and results in disclosure of sensitive information. The CVSS score of 9.6 indicates a high severity, although the description notes a low Chromium security severity and does not claim code execution or sandbox escape.

Google Chrome versions prior to 156.0.8078.47 on any platform are vulnerable. The 156.0.8078.47 release, part of the stable channel, contains the necessary fix.

The high CVSS score underscores the potential for significant data loss. The EPSS score of <1% and absence from CISA’s KEV catalog indicate that widespread, automated exploitation is currently unlikely, yet a remote attack via a malicious web page remains viable. An attacker can trigger the discrepancy by hosting or altering a page that a user visits, resulting in leakage of cross‑origin data from the browser’s internal memory. Because the issue does not provide sandbox escape or privilege escalation, the impact is confined to information disclosure unless combined with another weakness.