The vulnerability is an information disclosure flaw in the Document Object Model of Google Chrome versions prior to 156.0.8078.47. A malicious web page can trigger the bug by delivering carefully crafted HTML, causing the browser to expose sensitive data such as cookies, credentials, or other private user information. This flaw is an instance of CWE‑200, describing unintended disclosure of information. The leak does not enable direct code execution, but the compromised data could facilitate subsequent attacks or privacy violations.

Google Chrome browsers running any version earlier than 156.0.8078.47 on any platform. The flaw is present in the stable channel and affects all platforms where Chrome is installed.

The CVSS score of 8.8 indicates high severity. The EPSS score of < 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in CISA KEV, indicating no publicly known exploits yet. It can be triggered by serving malicious HTML to a victim, requiring the user to visit or load a crafted page. The likely attack vector is remote via a malicious web page. The flaw is mitigated by applying the official patch in Chrome 156.0.8078.47 or later.