The vulnerability is an improper certificate validation flaw in the Network component of Google Chrome on Windows. Remote attackers can craft malicious network traffic that bypasses TLS certification checks, allowing them to leak sensitive data that should otherwise be protected. The flaw is classified as CWE‑295.

Affected systems include any user of Google Chrome versions earlier than 156.0.8078.47 running on Windows operating systems. The vulnerability does not affect other platforms or later Chrome releases that include the fix.

The CVSS score of 8.8 reflects a high potential impact, while the EPSS score of less than 1% indicates that exploitation has not been widely observed. The vulnerability is not yet listed in the CISA KEV catalog. Although the description frames it as a data‑leak issue, the nature of the flaw could, in theory, allow a remote attacker to read privileged information by exploiting certificate validation, which can be a precondition for further attacks. Attackers would need to target an unpatched Chrome instance behind the victim’s network and send specially crafted traffic.