The vulnerability is a memory corruption bug in Chrome’s ServiceWorker implementation combined with missing authorization. A remote attacker can send a crafted HTML page that is parsed by the ServiceWorker, enabling the attacker to read data that originates from a different origin. The flaw is a missing‑authorization weakness (CWE‑862) that was rated with a CVSS score of 8.8, indicating high severity. Successful exploitation would result in the disclosure of user data that the browser has access to, potentially including sensitive information stored by extensions or other web pages.

All users of Google Chrome before version 156.0.8078.47, including desktop builds on all supported operating systems, are affected. The issue is limited to the specified version range.

The EPSS score of less than 1% indicates a very low current exploitation probability, but the web‑based attack vector and the high CVSS score mean that a realistic exploit could still be mounted by any site that an infected user visits. Because the flaw enables cross‑origin data disclosure without proper authorization, it poses a serious threat to confidentiality. The vulnerability is not listed in the CISA KEV catalog; however, its medium Chromium severity and high CVSS underscore the need for prompt remediation.