Type confusion in Fonts in Google Chrome prior to 156.0.8078.47 allows a remote attacker to read memory located outside the sandbox via a crafted HTML page, exploiting social engineering. The flaw permits an out‑of‑bounds read that bypasses Chrome’s sandbox, exposing potentially sensitive data. This vulnerability is identified as CWE‑843.

Google Chrome browsers with a version earlier than 156.0.8078.47. Users of the stable channel before the October 2026 update are at risk.

The flaw is triggered by delivering a crafted HTML page, meaning it is a remote network‑based attack. The CVSS score of 6.5 indicates moderate severity, while the EPSS score of <1% highlights a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Once the attacker bypasses the sandbox, they may read memory that could contain confidential information or facilitate further attacks, but the Chromium severity rating of Low suggests practical impact is limited.