Technical impact
The vulnerability in Google Chrome arises from insufficient policy enforcement within the Paint component, a flaw that aligns with CWE-639 and CWE-79, allowing a remote attacker to evade the same-origin policy by serving a specially crafted HTML page. This flaw enables the attacker to access resources that should be restricted to the page’s origin, potentially exposing private data or executing code in a trusted context. The issue was identified in Chrome versions prior to 149.0.7827.53.
Affected Systems
The affected product is Google Chrome, with versions older than 149.0.7827.53 vulnerable on all platforms. The advisory targets the stable channel but the defect exists in the underlying browser engine, so any instance using those earlier releases is at risk.
Risk and Exploitability
Risk assessment shows a Medium Chromium severity rating. The CVSS score of 6.5 and EPSS score of < 1% indicate a moderate risk level with a very low probability of exploitation, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting that widespread attacks are unlikely at present. Nevertheless, the attack vector requires only a malicious webpage and no privileged access, making remote exploitation straightforward for an attacker with the ability to serve crafted content to victims. The absence of a high CVSS score does not eliminate the need for timely patching, especially for environments that handle sensitive data.
Debian DSA