The vulnerability is a privilege elevation flaw in the Google Lens component of Google Chrome, which allows a remote attacker who has compromised the renderer process to obtain sensitive information by serving a specially crafted HTML page. The exploit leverages a use‑after‑free that elevates the attacker's privilege within the renderer, providing access to data that would normally be protected by the browser sandbox. The CVSS score of 8.8 reflects the high potential for confidentiality compromise.

Affected systems are users of Google Chrome on the stable channel running versions older than 156.0.8078.47. The flaw was present in previous Chrome releases that incorporated the Lens feature. The issue was fixed in Chrome 156.0.8078.47, which is no longer vulnerable to the described use‑after‑free.

An attacker who has already compromised the renderer process can serve a crafted HTML page that triggers the use‑after‑free in the Lens component, leading to a privilege elevation that permits extraction of sensitive information. Because the flaw occurs inside the sandboxed renderer, the attacker does not gain arbitrary code execution but can access protected data. The CVSS score of 8.8 indicates a high severity risk to confidentiality, while the EPSS score of < 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA KEV, but its high impact warrants prompt remediation.