A flaw in the Glic component of Google Chrome allowed a remote attacker who had already gained control of the renderer process to extract confidential data from the renderer’s original origin through a specially crafted HTML page. The data leaked could include credentials or other sensitive content visible only to the renderer’s origin, without modifying system files or bypassing authentication.

Google Chrome browsers running any version prior to 149.0.7827.53 on the stable channel are vulnerable. The vulnerability resides in the Glic component used across desktop releases.

The CVSS score of 6.5 reflects a medium severity vulnerability. An attacker must first compromise the renderer process, a step that represents a lateral move in Chrome’s multi‑process architecture. The EPSS score of <1% indicates an extremely low but non‑zero probability of exploitation, and the issue is not listed in CISA’s KEV catalog. The flaw maps to CWE‑20 (Improper Input Validation), CWE‑346 (Missing Authorization), and is also identified as NVD‑CWE‑noinfo, underscoring the importance of input validation and access control in preventing cross‑origin data exposure.