An observable discrepancy in CSS in Google Chrome prior to 156.0.8078.47 allows a remote attacker to obtain sensitive information by delivering a crafted HTML page. The flaw is identified as CWE‑203, Information Exposure, and CWE‑825, Resource Exhaustion, indicating that the browser may inadvertently expose data and consume resources. The vulnerability does not grant arbitrary code execution, but it can lead to disclosure of data the browser holds, such as credentials or other sensitive data stored in the browser. The impact is limited to the data exposed through the web page context.

Google Chrome versions earlier than 156.0.8078.47 on all supported platforms where the CSS functionality is enabled are affected. The problem originates in the Chrome browser delivered by Google.

The CVSS score of 8.8 signals a high severity risk. The EPSS score of less than 1% indicates a very low probability that the flaw is actively exploited at this time. The flaw is not listed in the CISA KEV catalog, so there is no publicly documented exploitation. Based on the description, it is inferred that the attack vector is remote via the web, relying on a victim visiting a malicious site that contains the crafted CSS. An attacker would need to host a webpage that the victim opens to exploit the issue.