The latest CVE narrative describes a use‑after‑free flaw in Chrome’s Performance module; before the 156.0.8078.47 release, a local attacker can trigger the error to read arbitrary memory owned by the browser process. This flaw stems from inadequate state validation, allowing the browser to expose memory contents it should not disclose. The vulnerability does not grant code execution or sandbox escape but does enable information disclosure of sensitive data (CWE‑754), which could be used to analyze or exfiltrate information from the machine.

All users of Google Chrome versions earlier than 156.0.8078.47 on any platform are affected. The Chrome stable channel received a mandatory update on October 2 2026, and the fix is included in the 156.0.8078.47 release and later. End‑points that have not yet installed the update remain vulnerable.

The CVSS score of 8.8 indicates significant severity, while the EPSS score is < 1%, indicating a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers must have local access to the victim’s system and may trigger the flaw by running a malicious program that interacts with Chrome’s Performance interface. With local privileges the attacker can read memory; thus the attack vector is local, not remote. Given the high CVSS and the low EPSS, the risk to exposed systems is considerable but the practical threat remains limited without local access.