A crafted HTML page can cause Google Chrome to treat cross‑origin requests as same‑origin, allowing an attacker to read private data from other sites. The flaw does not require local privileges and can be triggered by any user who opens a malicious page, resulting in potential data theft. The vulnerability is identified as a medium‑severity flaw in Chromium’s handling of DOM.

Google Chrome versions prior to 149.0.7827.53 are affected. Updating to the release that incorporates the patch removes the flaw.

The exploit requires the user to load a malicious page in Chrome. No exploit code is currently documented, but that does not preclude undisclosed exploits. The CVSS score of 6.5 indicates medium severity. The EPSS score is <1%, and the vulnerability is not listed in CISA’s KEV catalog. With user interaction required, the risk is moderate in environments with high exposure to malicious web content.