Memory corruption in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to read memory through a crafted HTML page, potentially exposing sensitive data. The vulnerability is a classic out‑of‑bounds read (CWE‑119) that does not require elevated privileges and can be triggered over the network by hosting a malicious site. The impact is purely confidential data leakage and no denial of service. The description does not explicitly state the attack vector; based on its nature it is inferred that this can be triggered by a malicious web page served over a network connection, potentially allowing confidential data leakage.

Google Chrome versions earlier than 156.0.8078.79 are affected. This includes all stable channel builds of the desktop release that deployed prior to the October 2026 update. The inclusion of all stable channel builds is inferred from the release notes referenced and is not directly detailed in the description.

The CVE is classified as high severity by Chromium. EPSS data is not available, so the exploitation probability is unknown; users should assume the threat could be leveraged by a remote attacker whenever the vulnerable version is in use. The vulnerability is not listed in CISA KEV, but the high severity and remote memory read capability make it a serious risk for any organization that can not immediately update the browser. The description does not expressly describe the privilege level of the attacker; it is inferred that exploitation can be performed remotely without elevated privileges, as suggested by the mention of a crafted HTML page.