A flaw in Google Chrome prior to version 156.0.8078.47 arises from incomplete cleanup in the browser, which can be triggered by a specially crafted HTML page. The vulnerability is classified as a use‑after‑free and improper cleanup, identified by CWE‑459 and CWE‑825. The impact is a breach of the web origin policy, allowing an attacker to re‑use resources across origins. Based on the description, it is inferred that the attacker could retrieve cross‑origin data or perform other data‑exfiltration attacks. This circumvents the same‑origin restriction, compromising confidentiality and integrity within the victim’s browser session.

Google Chrome desktop users running any release before 156.0.8078.47 are affected. Any machine that has not yet updated to this version is at risk, regardless of operating system.

The CVSS score of 8.8 denotes a high‑severity issue, but the EPSS score of <1% suggests a very low chance of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, indicating no publicly confirmed exploitation. The attack likely requires the victim to open a malicious HTML page in Chrome; therefore, the vector is remote via a crafted web page. If that condition is met, the incomplete cleanup would trigger the exploit, enabling the attacker to conduct cross‑origin data access and other related attacks.