Insufficient validation of untrusted input within Chrome’s DevTools before version 149.0.7827.53 enables a remote attacker who has already compromised the renderer process to bypass the same-origin policy through a crafted HTML page. The flaw is an input validation error (CWE‑20) and also involves a missing authentication or privilege check (CWE‑346) and is classified by Chromium as a Medium severity vulnerability, potentially exposing local resources or facilitating lateral movement within the client.

All users running any Google Chrome version older than 149.0.7827.53, regardless of operating system, are affected. The issue resides in the DevTools component of the browser and can be triggered when a malicious page is loaded through the compromised renderer.

Chromium rates the vulnerability as Medium severity with a CVSS score of 6.5. The EPSS score is <1% and it is not listed in the CISA KEV catalog. Exploitation requires the attacker first to compromise the renderer process—a condition that may arise from a separate vulnerability or social engineering. Once achieved, the attacker can serve a crafted HTML page that escalates to same-origin policy bypass. While an active exploit is not known, the potential impact warrants prompt remediation.