Google Chrome before version 149.0.7827.53 contains an insufficient validation of untrusted input in its WebAppInstalls component. Because the input is not properly sanitized, an attacker who has already compromised the renderer process can craft a malicious HTML page that extracts data from other origins. The flaw is classified as CWE‑20 for unsafe input handling and CWE‑346 for flaw in authentication. The resulting effect is a cross‑origin data leak, exposing confidential information that would normally be protected by the same‑origin policy. No full remote code execution is provided, but the compromise of the renderer process can lead to significant confidentiality impact.

Affected variants are Google Chrome running the stable channel up to version 149.0.7827.53. Any system using those releases is potentially susceptible to the described data‑leak scenario.

The security team rates the flaw as Medium, reflected by a CVSS score of 6.5. An EPSS score of < 1% indicates a very low, but non‑zero, likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, indicating limited evidence of active exploitation. Exploitation requires an attacker to first subvert the renderer process—typically through local compromise or an advanced web‑based attack—after which the attacker can deliver the crafted HTML and read cross‑origin content. Given the need for renderer compromise, the leverage is moderate but the confidentiality impact and lack of active exploits suggest a risk that warrants swift patching.