A missing authorization flaw in Google Lens within Google Chrome prior to version 156.0.8078.47 allows a remote attacker who has already compromised the renderer process and leveraged social engineering to exploit a crafted HTML page and leak sensitive information. The flaw does not grant arbitrary code execution; it permits unauthorized disclosure of data within the Chrome sandbox.

All installations of Google Chrome older than version 156.0.8078.47 that include Google Lens are vulnerable. The issue affects desktop Chrome builds. No information is provided about other browsers or platforms.

The CVSS score of 8.8 still marks the vulnerability as high severity, but its impact is information leakage rather than code execution. The EPSS score remains < 1%, indicating a very low probability of exploitation, and it is not listed in CISA KEV. The attack vector requires a crafted web page and social engineering to entice the user to load the content; a prior compromise of the renderer process is also necessary. Successful exploitation allows the attacker to leak sensitive information from the Chrome sandbox.