The vulnerability is an information disclosure flaw in the Media component of Google Chrome. A remote attacker can supply a crafted HTML page that, when opened by a user, causes the browser to reveal sensitive data from the Media subsystem. Chromium reports the issue as low severity, but the CVSS score of 8.8 still indicates a high potential for data exposure. This leak corresponds to CWE-200.

This flaw affects all Google Chrome browsers released before version 156.0.8078.47. Users running any earlier build are susceptible unless a patch has been applied.

The CVSS score of 8.8 indicates a high severity. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known active exploitation. The likely attack vector is a malicious or compromised web page that a user visits, which requires the user to load the crafted HTML. Although the flaw does not allow code execution, its high potential for data exposure warrants immediate remediation.