A flaw in the policy enforcement for ServiceWorker in Google Chrome allows a remote attacker, by providing a crafted HTML page, to read data that originates from a different origin. The vulnerability is characterized by insufficient boundary checks, enabling the attacker to bypass normal same‑origin restrictions and leak sensitive information. The impact is therefore the unauthorized disclosure of data that should be protected by browser‑origin policies. The flaw is classified as CWE‑346, representing a missing policy enforcement on sensitive functionality.

The issue affects Google Chrome versions prior to 149.0.7827.53. Any installation of this Chrome release running on a desktop that has ServiceWorker enabled is potentially vulnerable. The problem does not extend to later Chrome releases that contain the fix.

The EPSS score is less than 1%, indicating a very low likelihood of exploitation. The CVSS base score is 6.5, reflecting a medium severity. However, the vulnerability allows a local HTML page to request resources across origins, exploiting Chrome’s ServiceWorker implementation; this attack vector is feasible in a browser context with a crafted page. The overall risk is moderate, with the likelihood of exploitation dependent on an attacker’s ability to serve a malicious page to the target user. The lack of a KEV listing suggests that this issue is not an actively exploited vulnerability at present.