The vulnerability is a missing authorization flaw in Google Chrome’s Scheduling component that allows a remote attacker to obtain sensitive information when a user visits a crafted HTML page. The flaw is triggered by input designed to interact with the Scheduling API without proper access checks, enabling the attacker to read data that should be restricted within the browser’s context. The impact is loss of confidentiality of data accessed within the browser.

Affected systems are Google Chrome browsers with versions prior to 156.0.8078.47 installed on any supported platform. Users using the stable channel before the 156.0.8078.47 release are at risk, regardless of operating system. The affected version range is explicitly noted in the product update bulletin linked in the references.

The exploit path requires a user to load a maliciously crafted web page that triggers the unauthorized read. The flaw allows remote attackers to obtain sensitive information, resulting in loss of confidentiality. The CVSS score of 8.8 indicates high severity. The EPSS score of < 1% indicates a very low chance of exploitation. Since the flaw is not listed in CISA KEV and requires user interaction, the overall risk remains moderate until patched.