The vulnerability is an information leak in the ContextualSearch component of Google Chrome versions prior to 156.0.8078.47. It permits remote attackers to use social engineering and specially crafted network traffic to recover sensitive data that should have been protected. The weakness is categorized as CWE‑200, indicating an inadvertent disclosure of information. If exploited, the attacker could see data such as user queries, browsing history, or other locally stored information while within the browser context.

Google Chrome versions prior to 156.0.8078.47 are affected. Any installation of Chrome on consumer, enterprise, or developer machines without the latest update should be considered at risk.

The vulnerability has a CVSS score of 8.8, indicating high severity. The EPSS score is <1% and the issue is not listed in CISA’s KEV catalog. The likely attack vector is a remote attacker leveraging social engineering to craft network traffic that triggers the ContextualSearch component, causing unintended data exposure. Successful exploitation can lead to the disclosure of sensitive information stored or processed by the browser, compromising user confidentiality within the browser environment.