A crafted HTML page can trigger an information leak in the Performance APIs of Google Chrome on Android versions prior to 156.0.8078.47, allowing a remote attacker to read sensitive data from the browser. The flaw is associated with incorrect handling of input data (CWE‑200) and memory errors (CWE‑825), leading to a confidentiality compromise without enabling code execution. Although the Chromium security severity is listed as low, the CVSS score indicates a high impact on data confidentiality.

Google Chrome on Android versions prior to 156.0.8078.47 are affected. Users who have not updated to this or newer releases remain at risk. The CVE references Android builds, but the impact on desktop Chrome builds is not explicitly confirmed.

The CVSS score of 8.8 reflects a high severity for confidentiality impact, while the EPSS score is less than 1%, indicating a low likelihood of exploitation. The vulnerability can be triggered by a crafted web page, allowing an attacker to read sensitive data from the browser. The flaw is not listed in the CISA KEV catalog, and an official Chrome update (156.0.8078.47 or newer) provides a fix, so updating mitigates the risk. The likely attack vector is a malicious web site or phishing page delivering the crafted HTML content.