Missing authorization in Google Chrome’s Speech component prior to 156.0.8078.47 allows a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. A maliciously crafted HTML page delivered to the user through social engineering can trigger the bug, allowing a remote attacker to read memory within the browser sandbox and obtain sensitive information. This can leak confidential data but does not permit code execution. The weakness is classified as CWE‑862, indicating missing authorization.

Google Chrome browsers running any version prior to 156.0.8078.47 are affected. The vulnerability applies to all platforms where Chrome is available.

According to the data, the flaw has a medium severity rating of 6.5. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, indicating no currently known widespread attacks. Exploitation requires a remote user to open a specially crafted web page in Chrome, implying that user interaction or a compromised site is necessary. The attack vector is inferred as a web‑based attack, and the impact is limited to data exfiltration from the sandbox rather than full remote code execution.