An observable discrepancy in the Forms component of Google Chrome versions before 156.0.8078.47 allows a remote attacker, through social engineering and a malicious HTML page, to cause the browser to output or transmit sensitive information entered or stored within the form interface. The flaw does not provide arbitrary code execution, but it can expose confidential data that the user entered or accessed via forms.

Google Chrome browsers running any build before 156.0.8078.47 are potentially vulnerable. The issue is limited to the Forms feature and does not affect other components of the browser. No specific hardware or operating system constraints are mentioned.

With a CVSS score of 9.6, the vulnerability is considered critical, reflecting a severe confidentiality impact. The EPSS score is < 1%, indicating a currently low exploitation probability, and it is not listed in the CISA KEV catalog. An attacker can trigger the issue by serving a malicious HTML page to an unsuspecting user, so the vulnerability is exploitable remotely without additional prerequisites.