Chrome’s extension subsystem contains a flaw that permits a remote attacker to read data that is normally protected by browser cross‑origin policies when a crafted XML file is processed. The failure in XML handling can lead to confidentiality compromise by exposing sensitive information to an unauthorized party. The weakness is associated with information‑disclosure and is classified under CWE‑200.

The vulnerability affects all installations of Google Chrome that are earlier than build 149.0.7827.53. This includes the stable channel on Windows, macOS, and Linux platforms. Users who have not upgraded past that build remain exposed.

Chromium assigns a medium severity rating to this issue, and no EPSS score is currently available, so the precise likelihood of exploitation is unclear. Based on the description, it is inferred that an attacker would need to supply a crafted XML file to the victim, possibly by tricking the user into loading a malicious file or through a compromised extension. While the exact delivery method is not detailed, the existence of an information‑disclosure flaw warrants attention and prompt remediation.