Google Chrome features a flaw in the validation of untrusted data supplied by extensions. The vulnerability, classified as CWE‑20 and CWE‑79, allows an attacker who has already taken control of the renderer process to inject specially crafted HTML that bypasses the browser’s same‑origin policy. This bypass can enable reading from or writing to resources belonging to other origins, thereby compromising user confidentiality and integrity.

The issue affects all installations of Google Chrome with a version earlier than 149.0.7827.53, regardless of operating system. This includes Chrome running on macOS, Linux, and Windows platforms, as indicated by the corresponding Common Platform Enumeration entries.

Exploitation requires an attacker to first compromise the renderer process, which typically involves malicious or manipulated extensions or web content. The CVSS score of 6.5 indicates a medium severity risk, and the EPSS score of <1% suggests a very low likelihood of active exploitation at present. The vulnerability is not listed in the CISA KEV catalog, reducing the probability of widespread attacks. The primary risk is that a determined attacker with renderer control could elevate privileges within the browser to access data from other origins.