In Google Chrome prior to 149.0.7827.53, the Web Share function was implemented in a way that allowed a malicious web page to trick a user into executing specific UI gestures. When the user performed those gestures, data from another origin could be inadvertently shared. The flaw stems from improper input validation (CWE‑20 and CWE‑346) and results in the leakage of sensitive cross‑origin information. The assigned Chromium severity is Medium, indicating that while the vulnerability is not immediately destructive, it can expose confidential data.

Google Chrome versions earlier than 149.0.7827.53 are affected. Users must upgrade to a version that includes the fix (149.0.7827.53 or later).

The vulnerability is exploitable only when the victim visits a malicious site and follows a trick that triggers the Web Share gesture. There is no publicly known exploit and the CVE is not listed in the CISA KEV catalog. The CVSS score of 6.5 indicates a medium severity, and the EPSS score of < 1% suggests a low likelihood of exploitation. The requirement for a user action indicates a moderate risk for exposed data.