An observable discrepancy in Chrome’s Network stack before version 156.0.8078.47 enables an attacker to expose data that should be protected by the same‑origin policy. The flaw is a classic information‑exposure vulnerability (CWE‑203), allowing a remote attacker to read data from cross‑origin contexts when browsing a specially crafted HTML page. If exploited, the attacker could exfiltrate confidential information such as session tokens or sensitive data present in the victim’s browsing context, without executing arbitrary code.

The vulnerability affects Google Chrome releases prior to 156.0.8078.47. All such builds are potentially exploitable unless patched.

The high CVSS score of 8.8 reflects the significant impact of unauthorized data disclosure. The EPSS score of < 1% indicates a low probability of imminent exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote; an attacker can trigger the flaw by serving a malicious HTML page that causes the observable discrepancy in the Network component to expose cross‑origin data. This attack requires no local code execution or privilege escalation, and the exposed data types depend on the victim’s browsing history and session cookies.