The vulnerability arises from insufficient policy enforcement in CSS parsing in Google Chrome versions prior to 149.0.7827.53. A malicious web page can provide specially crafted CSS rules that cause the browser to read data from a different origin, thereby leaking sensitive information. This flaw does not provide direct code execution but allows a remote attacker to observe cross‑origin data that normally would be inaccessible.

All users running Google Chrome on Windows, macOS, or Linux with a stable‑channel version older than 149.0.7827.53 are susceptible. The issue is confined to the stable releases; other channels are unaffected according to the advisory.

Chromium classifies this issue as Medium, reflected by a CVSS score of 4.3, indicating a moderate severity level. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits. The likely attack vector is a user visiting a web page that hosts the crafted CSS; no elevated privileges or code execution are required to achieve the information disclosure.