The vulnerability is a UI misrepresentation within Google Chrome’s Transactions Platform. When the renderer process is already compromised, a maliciously crafted HTML page can be served to the victim. The flaw allows the attacker to access sensitive information that would normally be protected by the browser’s sandbox, effectively leaking private data to the attacker. The weakness is classified as CWE-451.

All OS platforms where Google Chrome’s Transactions Platform is enabled—including Windows, macOS, Linux, and Android—are affected. Every release of Chrome before version 156.0.8078.47 contains the flaw; that patch revision and later versions include the fix.

The CVSS score of 8.8 indicates high severity, but the EPSS score of less than 1% points to a very low expected probability of exploitation. The vulnerability is not in CISA’s KEV catalog. The likely attack path involves a remote attacker serving a crafted web page to a device where the renderer process has already been compromised, enabling the leakage of sensitive data.