The vulnerability is an incorrect authorization flaw in the Canvas implementation of Google Chrome, which allows a remote attacker to obtain cross‑origin data via a crafted HTML page. Based on the description, the attack leverages a misuse of the same‑origin policy that permits reading protected data from an external origin. This high‑severity flaw, identified as CWE‑863, exposes sensitive information to any user who views a malicious page rendered by the vulnerable browser.

The flaw exists in Google Chrome versions prior to 156.0.8078.47. Any installations running an older build of the stable channel are vulnerable to this incorrect authorization defect, which enables cross‑origin data access through the Canvas element.

Based on the description, an attacker can embed malicious content in a web page viewed by a victim, such as through email or a compromised site, and leverage a crafted HTML page that exploits the Canvas misuse of the same‑origin policy to read data from a different origin. The EPSS score of <1% indicates a low current exploitation probability, and the flaw is not listed in the CISA KEV catalog, but the high CVSS rating and potential for sensitive data exposure present a significant risk.