The vulnerability arises from an improper handling of CSS in Chrome versions prior to 149.0.7827.53, allowing a remote attacker, via a crafted HTML page, to exfiltrate cross‑origin data. The flaw enables disclosure of information that should be protected by same‑origin enforcement, potentially exposing confidential data without privilege escalation.

Google Chrome users using any version before 149.0.7827.53 are affected; no sub‑product or specific patch list beyond the last non‑patched version is provided. The issue targets the standard desktop Chrome browser across all platforms.

The CVSS score of 4.3 indicates medium severity, and the EPSS score below 1% suggests a low exploitation likelihood. The flaw is not listed in the CISA KEV catalog. Attackers would need to host or trigger a malicious page that the victim visits, then exploit the CSS bug to read data from another origin; no elevated privileges are required, making the risk broad for end‑users.