The vulnerability is a race condition in Chrome’s OptimizationGuide component that can be triggered by a crafted HTML page. It permits a remote attacker to leak sensitive data from the browser’s memory space, resulting in information disclosure such as credentials or session tokens. Chromium classifies the flaw as Medium severity. Based on the description, it is inferred that the vulnerability does not provide direct code execution or privilege escalation.

Google Chrome versions prior to 156.0.8078.47 are affected. Any user running these versions on the stable channel is at risk.

The CVSS score of 8.8 indicates a high severity, but the EPSS of <1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed public exploits. The likely attack vector is remote via a malicious web page, enabling an attacker to capture sensitive information from the browser’s memory. While this alone does not grant full system compromise, the data exposure can be leveraged for credential theft, phishing, or other downstream attacks.