The vulnerability is a missing authorization flaw in Google Chrome’s DevTools that existed in versions prior to 156.0.8078.47. It allows a remote attacker to obtain sensitive information by delivering a crafted Chrome extension. The flaw is classified as an Authorization Control Failure (CWE‑862) and results in information disclosure. The specific nature of the disclosed information is not detailed in the CVE report, so the potential impact may vary.

The affected are all releases of Google Chrome prior to version 156.0.8078.47. Any desktop installation of these versions remains vulnerable until an update is installed.

The CVSS score of 8.8 indicates a high‑severity risk, while the EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can exploit the missing authorization control in DevTools by using a malicious Chrome extension to read privileged data. The attack requires that the victim’s Chrome session is active and that the attacker can leverage the extension mechanism, implying that user interaction may be involved. Although the vulnerability does not provide arbitrary code execution, the potential loss of confidentiality could be critical.