This vulnerability allows a remote attacker who has already compromised the renderer process to bypass the web origin policy in Google Chrome versions prior to 154.0.8037.92. By loading a specially crafted HTML page, the attacker can trick the renderer into treating cross‑origin resources as if they were from a trusted origin, potentially exposing confidential data, executing unauthorized actions, or manipulating site content. The weakness is presented by inappropriate CORS checks and missing authorization, mapping to CWE-346 and CWE-862.

The affected product is Google Chrome. Versions before 154.0.8037.92, all builds derived from the Chromium project, are impacted. Users should verify whether they run any pre‑stable channel or older stable releases below this version number.

The CVSS score of 6.5 indicates medium severity. No EPSS score is available, suggesting no quantified exploitation probability at this time, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker first gain execution in the renderer process, which typically demands a prior local or medium‑privilege vulnerability. Once renderer compromise is achieved, the attacker can bypass CORS protection by serving a crafted page, leading to data exfiltration or unauthorized actions across origins.