Insufficient validation of untrusted input in the DevTools component of Google Chrome allows a remote attacker who has already compromised the renderer process to bypass the same‑origin policy by serving a specially crafted HTML page. This flaw can enable the attacker to read or modify data from other origins, effectively leaking sensitive information or allowing further attacks. The weakness is an instance of improper input validation, classified as CWE‑20.

The affected product is Google Chrome. Versions prior to 149.0.7827.53 are vulnerable. All users running any older stable release can be impacted if the renderer process is compromised by an attacker or malicious code.

The vulnerability is rated as high severity by Chromium. Although the EPSS score is not available, the lack of a CISA KEV listing suggests no publicly known widespread exploitation yet. The likely attack vector requires an attacker to first compromise the renderer process, which may occur through compromised extensions, malicious content, or other local privilege escalation. Once the renderer is controlled, the same‑origin policy can be bypassed with a crafted page, granting read or write access to cross‑origin resources.