This vulnerability is an improper input‑validation flaw in Chrome's DataTransfer implementation that can be triggered by a crafted HTML page. The flaw enables a remote attacker using social engineering to read cross‑origin data, effectively exfiltrating data from other sites that the user visited. The vulnerability was classified as Medium severity by Chromium security investigators, but the high CVSS score of 8.8 indicates a serious risk to confidentiality.

The affected product is Google Chrome on desktop platforms. All builds before version 156.0.8078.47 are vulnerable; later releases contain the fix.

The CVSS score of 8.8 indicates a highly exploitable weakness. The EPSS score of less than 1% signifies a very low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack scenario requires a user to visit a malicious web page with specially crafted content, enabling a remote attacker to trigger the input‑validation error and obtain cross‑origin data. No elevated privileges are required beyond normal browsing access.