Chrome’s extension subsystem has a validation flaw that permits remote attackers to read data that is normally protected by cross‑origin policies when a crafted XML file is processed. The problem stems from inappropriate handling of XML in extensions, which can lead to confidential data leakage. The weakness is linked to CWE‑346 (Improper Neutralization of Special Elements) and CWE‑352 (Cross‑Site Request Forgery). Based on the description, the flaw can be triggered when a malicious XML file is processed by an extension, implying a remote attacker could deliver the file.

Affected all versions of Google Chrome prior to build 149.0.7827.53. This includes the stable channel on Windows, macOS, and Linux. Any installation that has not been updated to at least this build remains susceptible.

The CVSS score of 6.5 indicates a medium severity issue, and an EPSS score of <1% shows a very low, but non‑zero, probability of exploitation. The vulnerability allows a remote attacker providing a crafted XML file to read cross‑origin data, potentially exposing sensitive information. The vulnerability is not listed in the CISA KEV catalog, reducing the likelihood of an actively weaponized exploitation. However, the attack could be delivered by a malicious extension or by tricking a user to open a file; security teams should monitor for such attack vectors.