Information leak in the Core component of Google Chrome prior to 156.0.8078.47 enables a remote attacker to leverage social engineering and deliver a crafted HTML page that, when opened by a user, leaks sensitive data from the browser’s sandbox. The flaw is classified as a CWE‑200 information‑disclosure vulnerability and is considered low severity by Chromium security.

The vulnerability affects Google Chrome desktop releases on all supported operating systems for versions earlier than 156.0.8078.47. Users operating any pre‑156.0.8078.47 build are exposed; all newer releases have remedied the flaw.

With a CVSS score of 8.8, this issue is classified as high severity, but Chromium internally classifies it as low. The EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remote web page containing crafted content that exploits information exposure via social engineering, requiring the user to open or view the malicious page within the browser environment.