The vulnerability is a missing authorization flaw in the Contacts component of Google Chrome versions prior to 156.0.8078.47. An attacker who has already compromised the renderer process—typically via a malicious HTML page delivered through social engineering—can read a user’s contact data without the proper permission checks. The weakness is identified as CWE‑862. While the CVE title suggests remote code execution, the official description focuses on information disclosure rather than arbitrary code execution.

All installations of Google Chrome that are not updated to version 156.0.8078.47 or later are susceptible. The flaw is present across all operating systems where the affected Chrome build runs, meaning any device without the security update is at risk.

The CVSS score of 8.8 indicates high severity. The EPSS score of <1% suggests a very low probability of exploitation currently. The vulnerability is not listed in the CISA KEV catalog, so no known active exploitation has been observed. Attackers can exploit this remotely by delivering a malicious HTML page that leverages the missing authorization to read contact data. However, the attack requires prior compromise of the renderer process, reducing the feasibility of an unauthenticated attack. Overall, the risk remains high until the update is applied.