The vulnerability is an authorization flaw in Chrome DevTools (CWE-863). A remote attacker can manipulate the DevTools interface via a crafted HTML page and gain unauthorized access to cross-origin content. The exploit does not involve memory corruption or arbitrary code execution; instead it permits leakage of data that otherwise would be protected by the same-origin policy.

Google Chrome users running any build prior to 156.0.8078.47 are affected. The flaw is triggered when a maliciously crafted HTML page causes DevTools to open, a feature accessible from any website. Users on affected versions who view such pages can have cross-origin data leaked back to the page.

The flaw carries a CVSS score of 8.8, indicating high impact. The EPSS score is < 1%, reflecting a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker delivering a malicious webpage that forces DevTools to activate, enabling the cross-origin data leakage; successful exploitation would expose sensitive information from other domains.