An attacker who can supply an HTML page to a Chrome browser can exploit an improper access control flaw in the V8 JavaScript engine, allowing the page to read arbitrary memory from the browser process. This vulnerability can expose sensitive data such as passwords, cookies, or other confidential information stored in memory. The weakness is classified as CWE‑284 and the community severity rating is high.

Google Chrome browsers running versions prior to 156.0.8078.73 on any desktop platform are vulnerable. The flaw exists in the V8 engine that powers JavaScript execution across all Chrome channels that include this version.

The vulnerability can be leveraged remotely by hosting a malicious web page that a user opens in Chrome; the attacker does not need local code execution. Although no EPSS score is available, the high severity rating and lack of a KEV listing indicate that the flaw is technically usable but may not yet be widely exploited. Without a vendor‑issued workaround, the primary risk remains until the browser is updated.