Incorrect authorization in Chrome's Performance API prior to 156.0.8078.47 allows a remote attacker to obtain cross‑origin data via a crafted HTML page. The flaw arises from insufficient sanitization of user‑supplied data that feeds the Performance APIs, cataloged as CWE‑863. The attacker can exfiltrate sensitive information without executing code within the browser sandbox.

Google Chrome browsers older than version 156.0.8078.47 are affected. The vulnerability exists in the core Performance API implementation shipped with the browser and is present on all supported platforms—Windows, macOS, Linux, Android, and iOS. Any client running these versions and visiting a crafted web page is at risk.

The CVSS score of 8.8 classifies the issue as high severity, and the EPSS score is less than 1 %, indicating a very low likelihood of exploitation given the current threat landscape. The flaw can be triggered remotely via a crafted HTML page served from a malicious website and is not listed in the CISA KEV catalog. A successful exploit allows an attacker to obtain cross‑origin data without executing code within the browser sandbox, resulting in data theft.