Observable discrepancy in form handling in Google Chrome prior to version 156.0.8078.47 allows a remote attacker to obtain sensitive information entered by a user through a crafted HTML page. The flaw is classified as CWE‑203 and results in unintended disclosure of user input data when the browser processes the page’s form fields.

Any user running Google Chrome on any platform with a version earlier than 156.0.8078.47 is affected. Versions 156.0.8078.47 and later are not verified to contain the flaw in this description, but the vendor’s stable channel release includes the fix for the discrepancy.

The CVSS score of 8.8 classifies this vulnerability as high severity. An EPSS score of <1% indicates a very low but non‑zero probability of exploitation. The bug is not listed in the CISA KEV catalog, indicating no confirmed large‑scale exploitation. The likely attack vector is a malicious HTML page served over the network that an end user visits, where the flaw causes the browser to reveal form inputs that the user otherwise would not see.