The flaw resides in the ComputePressure component of Google Chrome. An attacker can craft a malicious HTML page that exploits an observable discrepancy in ComputePressure before Chrome 156.0.8078.47, causing the browser to expose sensitive data from other origins. This bypasses the normal web origin policy, allowing a website to read or otherwise obtain content that belongs to a different domain. The vulnerability is characterized as CWE‑203, improper access control.

All users running Google Chrome versions older than 156.0.8078.47 on any platform are vulnerable. The vulnerability affects the stable channel of Chrome and any installations that have not yet received the patch included in the 156.0.8078.47 release.

The CVSS score of 5.4 indicates medium severity. Because an attacker only needs to host a crafted HTML page and persuade a user to load it, no privileged access or local code execution is required. The EPSS score remains below 1% and the issue is not listed in the CISA KEV catalog, implying that exploitation is currently unlikely. Still, the flaw allows a remote attacker to read protected data from other origins—a CWE‑203 weakness that can lead to privacy violations.