A missing authorization flaw in the Chrome extension system permits an attacker who has already compromised the renderer process to read sensitive information exposed by a crafted HTML page. The vulnerability, identified as CWE-862, could lead to the disclosure of confidential data from the browser's memory or extension contexts. The CVSS score of 8.8 indicates a high severity level, reflecting the potential impact if exploited in a real-world scenario.

Google Chrome desktop browsers earlier than version 156.0.8078.47 are affected. All users running any of those versions should be aware that the vulnerability exists in the extension handling code and can be triggered via a malicious webpage.

The CVSS of 8.8 highlights the seriousness of the flaw. Although the EPSS score is < 1% and the issue is not listed in the CISA KEV catalog, the potential for significant data leakage remains. Exploitation requires an attacker to first compromise the renderer process and then load a crafted HTML page to read sensitive data. The high CVSS combined with the ability to disclose confidential information makes this vulnerability noteworthy for systems exposed to untrusted web content.