The Vulnerability is incorrect authorization in PerformanceAPIs in Google Chrome prior to 156.0.8078.47, allowing a remote attacker to potentially obtain cross‑origin data via a crafted HTML page. This weakness, identified as CWE‑863, permits unauthorized access to protected resources, compromising data confidentiality.

Affected systems are installations of Google Chrome below version 156.0.8078.47 on any platform where Chrome is running. Google issued a stable‑channel update that resolves the issue in 156.0.8078.47 and later releases, as noted in the official update announcement.

The CVSS score of 8.8 indicates high severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The flaw is not listed in CISA’s KEV catalog. An attacker can host a malicious webpage and lure a user to visit it, exploiting the incorrect authorization to access cross‑origin data. The risk remains significant for users browsing untrusted content, as the vulnerability permits data leakage that could be leveraged for credential theft or other malicious activities.