Incorrect reference resolution in Chrome's FileSystem component before release 156 . 0 . 8078. 47 permits a remote attacker, often through social engineering, to use a crafted HTML page that triggers the flaw. The reference resolution bug allows the attacker to read data that should be confined within the browser sandbox, revealing sensitive information. This vulnerability is categorized as CWE‑706.

The affected product is Google Chrome, any release prior to 156.0.8078.47. Users running older stable channel builds are at risk. No other vendors or versions are listed.

The EPSS score of <1% indicates a very low exploitation probability, and it is not listed in CISA KEV. The CVSS score of 6.5 indicates a medium severity, consistent with Chromium's rating. While it does not provide code execution, it can expose memory contents via an exploited reference resolution flaw when an attacker controls the content of a web page. The likely attack vector is a malicious web page served remotely or locally that exploits the reference resolution bug. The risk persists for all users on affected versions until the official patch is applied.