A flaw in the Omnibox component of Google Chrome allows remote attackers to leak sensitive information through crafted network traffic. The issue is an information disclosure vulnerability (CWE‑200). When triggered, it can expose private data handled by the browser, such as search queries, credentials, or local information, without allowing the attacker to execute arbitrary code.

Versioned products affected are Google Chrome browsers on all supported platforms prior to 156.0.8078.47. The vulnerability applies to the stable channel releases up to that point, including all operating systems that Chrome runs on.

The CVSS score of 8.8 indicates high severity, yet the EPSS score of less than 1% suggests a very low probability of exploitation at present. The vulnerability is not listed in CISA KEV. The likely attack vector is through crafted network traffic that the Chrome browser processes, which may come from a malicious web page or a compromised site. Successful exploitation results in a confidentiality breach, allowing the attacker to read private information but does not grant code execution.