A flaw in the policy enforcement for Workers in Google Chrome allows an attacker who has already compromised the renderer process to bypass the browser’s same‑origin policy by serving a specially crafted HTML page. The impact is that the attacker can read or modify data that should be confined to a different origin, effectively leaking sensitive information or injecting hostile content. The weakness represents an improper access control violation, allowing cross‑origin access that the browser was designed to block.

Google Chrome browsers running any version prior to 149.0.7827.53 are affected. The vulnerability is specific to the rendering process where Workers are created, and no other Google products or vendor platforms are listed as impacted.

The vulnerability carries a CVSS score of 6.5, indicating medium severity according to Chromium’s internal assessment. The EPSS score is <1%, suggesting a very low probability of exploitation, and the issue is not listed in CISA’s KEV catalog, indicating it is not known to be actively exploited at the time of this analysis. The likely attack vector requires an attacker to first compromise the renderer process, which typically means that the attacker already has some foothold on the system. Once that foothold is present, the attacker can load a malicious HTML page that creates a Worker and then use the bypassed same‑origin policy to access data from another origin. Because the privilege escalation is limited to the renderer sandbox, the damage is confined to browser‑based data, though it can still expose credentials, cookies, or other sensitive information.