Incorrect authorization was found in the WebUI component of Google Chrome, allowing a remote attacker who had compromised the renderer process to read sensitive information via a specially crafted HTML page. The flaw exposes data that should otherwise be protected, but it does not grant direct control over the browser or the operating system. It is classified as CWE‑863: Incorrect Authorization.

The vulnerability affects all Google Chrome browsers released before version 156.0.8078.47. End‑users running any older builds are susceptible until they apply the security update in that version or later.

The CVSS score of 8.8 indicates high severity. Exploitation requires that the attacker first gains control of the renderer process, then serves a malicious HTML page to the victim’s browser. Based on the description, the attack vector is inferred to be from a crafted HTML page loaded in the compromised renderer; the actual likelihood is low with an EPSS score of <1% and the vulnerability is not listed in the CISA KEV catalog. The potential impact, however, is exposure of sensitive data to the attacker once the renderer compromise and crafted page are achieved.