An observable discrepancy in Media in Google Chrome before version 156.0.8078.47 enabled a remote attacker to potentially leak cross‑origin data via a crafted HTML page. The flaw lies in how media resources are processed, creating a vulnerability that can be triggered by loading malicious content. When exploited, the attacker may read data from other origins that the browser would normally isolate, compromising user privacy and potentially exposing sensitive information. The issue is rooted in improper memory handling, leading to unintended data disclosure.

All Google Chrome installations on Windows, macOS, and Linux released before version 156.0.8078.47 are affected. The issue has been remedied in later releases, so any user still running an older major release is vulnerable. Vendors using Chrome as part of enterprise or IoT ecosystems must verify that they have deployed the patched version.

This vulnerability carries a CVSS score of 8.8, indicating high severity. The EPSS score is less than 1%, suggesting a very low likelihood of exploitation at present. It is not listed in the CISA KEV catalog, implying no known widespread exploitation. The attack requires the victim to load a malicious HTML page, which is a remote, user‑interaction‑dependent vector. Once the crafted page is rendered, the flaw can leak cross‑origin data, potentially exposing sensitive session data or user interactions. The exploit does not grant arbitrary code execution but does expose information that could be used in downstream attacks.