Google Chrome versions prior to 149.0.7827.53 contain an insufficient validation of untrusted input in the WebAppInstalls component. This input‑validation flaw, classified as CWE‑20, allows an attacker who has compromised the renderer process to craft a malicious HTML page that can exfiltrate cross‑origin data. The vulnerability does not provide full remote code execution but does expose confidential information that would otherwise be protected by same‑origin policy.

Affected variants are Google Chrome running the stable channel up to version 149.0.7827.53. Any system using these releases is potentially susceptible to the data‑leak scenario described.

The security team rates the flaw as Medium within Chromium’s internal severity scale. No EPSS score is publicly available, and the vulnerability is not listed in CISA’s KEV catalog, indicating limited evidence of active exploitation. Exploitation requires an attacker to first subvert the renderer process—typically through local compromise or an advanced web‑based attack—after which the attacker can deliver the crafted HTML and read cross‑origin content. Given the need for renderer compromise, the leverage is moderate but the confidentiality impact and lack of active exploits suggest a risk that warrants swift patching.