Technical impact
The flaw lies in Chrome’s printing module. A crafted HTML page can exploit an improper input validation bug to expose data from other origins when the renderer process is already compromised. The consequence is a cross‑origin data leak, broadening the impact of any attacker who gains control over the renderer. This means sensitive information could be extracted from web pages that otherwise would not be accessible.
Affected Systems
Google Chrome versions earlier than 149.0.7827.53 on all supported desktop platforms are affected. The issue is tied specifically to the printing functionality incorporated into the browser.
Risk and Exploitability
The vulnerability requires a prior compromise of the renderer process, which may be achieved through separate code‑execution or privilege‑escalation flaws. The CVSS score of 6.5 indicates a medium severity, and the EPSS score is below 1%, suggesting exploitation is unlikely but still possible. The vulnerability is not listed in the CISA KEV catalog. The medium severity rating indicates that while the flaw is not immediately critical, prompt remediation is advisable to prevent data loss.
Debian DSA