A race condition in the Transactions Platform of Google Chrome, existing in all releases prior to 156.0.8078.47, allows a remote attacker who has already compromised the renderer process to obtain sensitive information through a crafted HTML page. This use‑after‑free flaw, identified as CWE‑367, can result in the extraction of confidential browser data.

Google Chrome Desktop, all releases prior to version 156.0.8078.47. The flaw exists in the Transactions Platform component of Chrome's rendering engine.

The CVSS score of 8.8 indicates a high‑severity impact for users running unpatched versions of Chrome. The EPSS score of < 1% suggests a very low probability of exploitation in the current environment, and the vulnerability is not listed in CISA’s KEV catalog. This use‑after‑free flaw requires that an attacker first compromise the renderer process; from there, the attacker can deliver a crafted HTML page to the victim to extract sensitive browser data. While no additional privileges or user interaction beyond opening the malicious page are needed, the need to compromise the renderer process reduces the likelihood of an successful attack. Nevertheless, the high confidentiality impact warrants prompt remediation.