The flaw resides in Chrome’s FileSystem implementation. A renderer process that an attacker has already compromised can serve a specially crafted HTML page that bypasses the normal same‑origin restriction. This abuse can allow the attacker to read or write sensitive data from other origins and potentially trigger further malicious behavior, representing a significant breach of confidentiality and integrity.

All desktop installations of Google Chrome prior to version 149.0.7827.53 on the stable channel are impacted. The vulnerability affects every user running a prior update on Windows, macOS, or Linux.

The CVSS score is classified as medium, and no EPSS score is publicly available, indicating limited evidence of current exploitation. The vulnerability was not listed in CISA’s KEV catalog. The attack requires an attacker to have already compromised the renderer process; once that condition is met, a crafted page can be served to exfiltrate data. The risk is therefore moderate to high for systems that cannot immediately remediate.