Information leak in Google Lens in Google Chrome prior to 156.0.8078.47 allows a remote attacker to craft a malicious HTML page that can leak cross-origin data via social engineering. Based on the reported cross-origin data leakage, it is inferred that improper isolation of the Lens component may be involved, enabling the unintended exposure of data between origins. The vulnerability is classified as an information exposure (CWE-200) and carries a low Chromium severity.

Google Chrome browsers running the stable channel prior to version 156.0.8078.47 are vulnerable. The issue is specific to the Google Lens feature embedded in Chrome.

The vulnerability can be triggered remotely by a malicious web page that a user visits. The CVSS score of 6.5 classifies it as medium severity, and the EPSS score of < 1% shows a very low probability of exploitation. It is also not listed in CISA KEV, further indicating a low likelihood of known exploit activity. Despite this, the ability to exfiltrate cross-origin data could lead to confidential data leakage, so timely mitigation is recommended.