An inappropriate implementation in the Media layer of Google Chrome before version 149.0.7827.53 allows a remote attacker to read data across origins by serving a specially crafted HTML page. This flaw does not require user interaction beyond visiting the malicious page and can expose confidential information that should be protected by same‑origin policy, thereby compromising the confidentiality of the victim’s data.

All Google Chrome desktop browsers running any version earlier than 149.0.7827.53 on publicly accessible systems, specifically the stable channel releases. The issue applies to all platforms that execute Chrome’s media components.

The vulnerability is rated as medium in Chromium’s internal severity scale. No EPSS score is available and the flaw is not listed in CISA’s KEV catalog. Exploitation requires only delivery of a crafted web page; no additional privileges are needed. The potential impact is the leakage of sensitive cross‑origin information, making the risk moderate but actionable by applying the available patch.