Insufficient validation of untrusted input in the DevTools component of Google Chrome allows a remote attacker who has already compromised the renderer process to bypass the same‑origin policy by serving a specially crafted HTML page. This flaw can enable the attacker to read or modify data from other origins, effectively leaking sensitive information or allowing further attacks. The weakness is an instance of improper input validation, classified as CWE‑20 and CWE‑346.

The affected product is Google Chrome. Versions prior to 149.0.7827.53 are vulnerable. All users running any older stable release can be impacted if the renderer process is compromised by an attacker or malicious code.

The vulnerability is rated with a CVSS score of 6.5 by Chromium, indicating medium severity. Although the EPSS score is only < 1% and there is no CISA KEV listing, the lack of public exploitation suggests it is not widely abused yet. The likely attack vector requires an attacker to first compromise the renderer process, which may occur through compromised extensions, malicious content, or other local privilege escalation. Once the renderer is controlled, the same‑origin policy can be bypassed with a crafted page, granting read or write access to cross‑origin resources.